Beedle - Oracle free perpetual lending

Summary

Contracts that are Ownable and have centralization risks

Vulnerability Details

Owner of contracts has certain privileges that can impact working of protocol for example below function owner can set their own address or address they control to take away fees from protocol
function setFeeReceiver(address _feeReceiver) external onlyOwner { //

or owner can mint Beedle tokens to any address of their liking
function mint(address to, uint256 amount) external onlyOwner {

Impact

Medium: If ownership is lost, goes rogue they can steal fees implying that the Staking contract is rendered useless. Having admin controlled functions opens up risks to centralization of the protocol. However, in the documentation it is not clear if the ownership will be Governance but there is indication of Lender.sol line 78 that contracts and onlyOwner functions are controlled by governance. If that is the case, this risk falls to lower level

Tools Used

Manual Analysis

Recommendations

It is recommended contracts that need to have owner have the owner as Governance Contracts or Multisig and risks of Ownable contracts are well understand, documented and informed