Beedle - Oracle free perpetual lending

Summary

A malicious borrower can exploit the pools using no-revert-on-transfer ERC20 tokens

Vulnerability Details

1. Alice creates a pool of a no-revert-on-transfer ERC20 token (as ZRX or EURS or BAT) and WETH with Lender.setPool()

2. Eve on her EOA1 borrows the no-revert-on-transfer ERC20 tokens (ZRX or EURS or BAT) of this pool as debt and gives WETH as collateral with Lender.borrow().

3. Eve changes her account to her EOA2 containing 0 ZRX or EURS or BAT and calls Lender.repay() with the loanIds of the loan taken with her EOA1.

4. The repay function goes through even if no ZRX or EURS or BAT tokens were transferred to the pool as repayment since these tokens don't throw but just return false when a transfer fails. -> The protocol fees are transferred to the fee receiver and the collateral tokens are transferred back from the pool to Eve and the loans[loanId] is deleted.

5. Therefore a malicious actor like Eve can successfully drain pools which are using token pairs with one no-revert-on-transfer ERC20 token.

Impact

Drain funds from the no-revert-on-transfer ERC20 token pools of the protocol.

Tools Used

Manual review.

Recommendations

Use OpenZeppelin's SafeERC20 library and safeTransferFrom() to handle such tokens.