Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Loans can exceed maximum loan ratio due to accrued interest

bauchibred

Summary

The Lender.sol contract has a design oversight which allows loans to bypass the defined maximum loan ratio due to the accumulation of interest over time this is due to the fact that the design doesn't have a mechanism to prevent a loan from exceeding the maximum loan ratio due to accrued interest.

Vulnerability Details

The Lender contract allows a user to borrow up to the defined maximum loan ratio. However, as interest accrues over time, the total debt (original loan + accrued interest) can exceed the initial maximum loan ratio.

Relevant code snippets:

Calculating the loan debt:

function getLoanDebt(uint256 loanId) external view returns (uint256 debt) {
Loan memory loan = loans[loanId];
// calculate the accrued interest
(uint256 interest, uint256 fees) = _calculateInterest(loan);
debt = loan.debt + interest + fees;
}

Setting the maximum loan ratio for a pool:

/// @notice update the max loan ratio for a pool
/// can only be called by the pool lender
/// @param poolId the id of the pool to update
/// @param maxLoanRatio the new max loan ratio
​
function updateMaxLoanRatio(bytes32 poolId, uint256 maxLoanRatio) external {
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (maxLoanRatio == 0) revert PoolConfig();
pools[poolId].maxLoanRatio = maxLoanRatio;
emit PoolMaxLoanRatioUpdated(poolId, maxLoanRatio);
}

Impact

A loan's effective ratio to could sidestep the defined maximum loan ratio, thus circumventing the contract's risk management rules.

Tools Used

Manual Audit

Recommended Mitigation

Implement a mechanism that enforces the maximum loan ratio even after interest accrual.

One possible solution could involve a regular check on outstanding loans and their accrued interest. If the accrued interest pushes the loan beyond the defined maximum loan ratio, a trigger of partial liquidation to bring the loan back within the maximum loan ratio could be done.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.