Beedle - Oracle free perpetual lending

Summary

The function addToPool allows the pool lender to add funds to a specific pool. However, there is a potential vulnerability in the way the pool balance is updated, which could lead to an integer overflow. If the poolBalance value is close to the maximum value of uint256, and a significant amount is added, an overflow could occur, resulting in an incorrect balance update.

Vulnerability Details

The issue lies in the line: uint256 newPoolBalance = pools[poolId].poolBalance + amount;. The function blindly adds the amount to the existing poolBalance without checking for potential overflow. If the poolBalance is already near the maximum value of uint256, adding a large amount could result in an overflow, causing the newPoolBalance to wrap around and become inaccurate.

Impact

The integer overflow vulnerability in the pool balance update could lead to an incorrect pool balance being displayed, potentially allowing the pool lender to withdraw more funds than are actually available in the pool. This discrepancy could lead to the lender withdrawing funds that should have been reserved for other users, disrupting the pool's intended behavior and causing financial losses.

Tools Used

Manual

Recommendations

Use safe arithmetic operations to handle the balance update.One way to achieve this is by utilizing the SafeMath library from OpenZeppelin, which provides functions for safe arithmetic operations to prevent overflows and underflows.