Summary

Reentrancy attack in repay function.

Vulnerability Details

A malicious user can reenter the repay before deleting his loan. Using tokens like - ZRX, EURS will not revert on Failure. This means that an attacker can get all of the collateral tokens.
POC
loan - ZRX
collateral - ether
On line #317
The attacker need to transfer to address(this), but he doesnt have any tokens. But it iwll not revert on failure, because of the loan token.
On line # 323
Is the same way
On line #329
The malicious user takes the collaterals tokens from the contract.

Impact

All of funds will be steal

Tools Used

Manual Review

Recommendations

To prevent this potential vulnerability, it is essential to ensure that loan repayment is processed only once. One way to achieve this is by maintaining a state variable that keeps track of whether a loan has already been repaid or processed. Before processing a loan, the function should check this state variable and ensure that the loan has not already been repaid. If the loan has been repaid, the function should return or revert to prevent reentrancy.