Loan Lender Can Be Changed Withouth Proper Balance
Summary
The loan lender field can be changhed by an attacker when buiyng the loan due to the missing validation.
Vulnerability Details
In the buyLoan function the loans[loanId].lender is set to msg.sender, howerer, it is not checked if the msg.sender is the new pool (poolId) lender.
Impact
This will allow an attacker to pass any poolId and become the loan lender, which will allow an attacker to start the auction, seize the loan and get collaterals, give the loan to another pool, and in case of loan repayment an attacker will be allowed to withdraw them.
Tools Used
Manual Review
Recommendations
Verify if msg.sender is the new pool lender in the buyLoan.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.