Beedle - Oracle free perpetual lending

Summary

The repay function in the smart contract enables users to repay one or multiple loans at once. However, there is a possibility of an underflow in this function due to the subtraction of loan.debt from pools[poolId].outstandingLoans without proper validation. This issue could lead to unintended behavior and potential loss of funds.

Vulnerability Details

The vulnerable line of code in the repay function is as follows:

This line attempts to subtract the loan.debt from the outstandingLoans value in the pools[poolId] storage. However, if the loan.debt value is greater than the current value of outstandingLoans, an underflow can occur.

Impact

If an underflow happens in the repay function, the outstandingLoans value in the pools[poolId] storage will wrap around to a very large positive value, potentially leading to incorrect calculations and loss of funds in the pool. Additionally, it may affect subsequent loan processing and balance calculations.

Tools Used

manual

Recommendations