Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

The contract is incompatible with fee-on-transfer ERC20 tokens. The poolBalance is recorded incorrectly.

Impact

1. The contract will track the incorrect poolBalance as the added amount to both will be always more than what was actually deposited.

2. When withdrawing (repay, refinance) from the contract, the user will receive less token amount than what they should receive.

3. The protocol will receive less fee than accounted.

4. Tokens cannot be withdrawn as there will be fewer tokens than stated in the poolBalance.

5. When the token balance would be insufficient after stating incorrect poolBalance. The pool would then use another pool's token balance as it is considered valid because the poolBalance still has balance in it.

Tools Used

Manual Review.

Recommendations

The only thing the protocol can control is during the credit transfer to the contract. The fee during withdrawal by the user cannot be controlled.

So, either disallow the use of fee tokens or limit the consequences of the fee token by following the given steps:

1. Add a beforeTransferBalance and track the balance of the contract before the token transfer.

2. Transfer the token.

3. Add a afterTransferBalance and track the new balance of the contract.

4. uint256 transferAmount = afterTransferBalance - beforeTransferBalance.

5. Update the pool balance. _updatePoolBalance(poolId, pools[poolId].poolBalance + transferAmount).