Beedle - Oracle free perpetual lending

Summary

Malicious lender can grief users' transactions changing the minLoanSize/maxLoanRation/poolBalance values.

Vulnerability Details

Malicious lenders can create a pool with a very beneficial loan ratio. As users request a loan by calling the borrow function, the lender can frontrun it and:

1. Change the maxLoanRation for a smaller value than the calculated loanRatio

2. Change the minLoanSize by calling the setPool function for a bigger value than the user would like to borrow

3. Decrease the pool balance.

In these situations, the user's transaction will revert.

Impact

User's gas griefing and potential loss of trust in the protocol, as users may experience transaction failures and doubt the reliability of the protocol.

Tools Used

Manual review

Recommendations

Consider implementing a delay for changing those values.