Beedle - Oracle free perpetual lending

Summary

When buying a loan in another pool, it is not checked whether the tokens of the previous and new pools match.

Vulnerability Details

In the buyLoan function it is not checked if the new pool (poolId) has the same pair of loan and collateral tokens as the old pool.

Impact

This will change the numbers of the mismatched token balances, which means that the actual token balances on the contract will not match the stored pool balances. Balances will be damaged and landers will withdraw and borrow tokens from other landers, and real token owners will not be able to withdraw their own tokens. This opens a window for manipulation and allows an attacker to steal tokens from the contract.

Tools Used

Manual Review

Recommendations

Verify if the tokens of the previous and new pools match in the buyLoan function.