Lender.sol - borrow() - Lender could frontrun the call updating the interest rate for a higher value
Summary
When borrow() is called, one or more loans are created using the current interestRate of the pool.
Such interest rate could be updated anytime by the pool lender without any restriction.
A malicious lender could offer a convenient interestRate, wait until a user tries to borrow money with such conditions calling borrow() and frontrun that transaction upgrading the current interest rate with a much worse value for the borrower, changing the lending conditions unilaterally.
Vulnerability Details
Impact
Tools Used
Manual Review
Recommendations
Add some timelock mechanism to updateInterestRate() or allow the borrower to send the max interestRate that he is willing to pay.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.