Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

buyLoan() doesn't have the requirement checking if the pool has the lender is msg.sender

Impact

Malicious user can do this:

1. A(malicious user) makes a pool

2. B(A's alternative account) lends A's pool

3. A immediately startAuction() the B's loan

4. A can buyLoan using C's pool

5. After this, pools[C's pool].poolBalance got decrease, and pools[A's pool].poolBalance got increase

6. A can removeFromPool() and take profit

Moreover, all of this step can execute in one transaction

Tools Used

Manual Review

Recommendations

Add the requirement if(pools[poolId].lender != msg.sender) revert NotOwner(); in buyLoan()