Beedle - Oracle free perpetual lending

Summary

User can buy a loan with pool which is not owned by him.

Vulnerability Details

function buyLoan must to be called with loanId and poolId without check if poolId is owned by msg.sender. As result is transfered loan to user pool which is payed by other user pool.
In function buyLoan missing check if(pools[poolId].lender == msg.sender)
For example:

1. Alice create pool with 50 DAI

2. Bob get a loan from Alice pool for 30 DAI

3. Bob not pay his loan and Alice start auction

4. Nobody buy a loan on auction

5. Attacker call buyLoan function with bob loanId and Alice poolId

6. Attacker is now owner of bob loan which is pay by Alice pool

Impact

User can lose funds due to somebody buy loan with they pool funds

Tools Used

Manual Review

Recommendations

Add check in buyLoan
if (pools[poolId].lender != msg.sender) revert Unauthorized();