Beedle - Oracle free perpetual lending

Summary

A malicious lender can reconfigure his pool by setting the new pool balance to be greater the earlier balance
and claim a larger deposit than actual

Vulnerability Details

Using the setPool() function on lending contract, the owner of a pool can reconfigure the pool.

As a malicious lender, the lender sets the new configuration for poolBalance to be greater than current balance.

Because of this, the lender contract will try to transfer the difference from the lender's account to the contract. But, since transferFrom is called and return value is ignored, while the underlying transfer fails,
the new setup for the pool is saved into the state of the contract.

As a result the lender holder larger number of ERC20 tokens that actually deposited.

Impact

Bypassing the lender contract logic to record more token lent to the protocol than actual, hence breaks the accounting system of the lender contract.

By doing this, the protocol will not have tokens that lender provided to it.

Tools Used

Manual Review

Recommendations

Use safeTransfer utility from openzeppelin