Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high

Malicious lender could withdraw more loan tokens than they are entitled too

gaxnik1

Summary

Malicious lender could withdraw more loan tokens than they are entitled too

Vulnerability Details

In Lender.sol, setPool() allows the lender to change the pool balance, even if the outstanding loans have not changed. This could be exploited by a malicious lender to withdraw more loan tokens than they are entitled to. https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L130-L176

Proof of Concept

For example, let's say that the lender has deposited 100 loan tokens in the pool and there are currently 50 outstanding loans. This means that the pool balance is 100 - 50 = 50.

A malicious lender could exploit this vulnerability by calling the setPool function with a new pool balance of 150. This would increase the pool balance by 100, even though the outstanding loans have not changed. This would allow the lender to withdraw 100 additional loan tokens, which they are not entitled to.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, the function setPool should only allow the lender to change the pool balance if the outstanding loans have also changed. This could be done by checking the outstandingLoans field before updating the poolBalance field.

function setPool(Pool calldata p) public returns (bytes32 poolId) {
// validate the pool
if (
p.lender != msg.sender ||
p.minLoanSize == 0 ||
p.maxLoanRatio == 0 ||
p.auctionLength == 0 ||
p.auctionLength > MAX_AUCTION_LENGTH ||
p.interestRate > MAX_INTEREST_RATE
) revert PoolConfig();
​
// check if they already have a pool balance
poolId = getPoolId(p.lender, p.loanToken, p.collateralToken);
​
// you can't change the outstanding loans
if (p.outstandingLoans != pools[poolId].outstandingLoans)
revert PoolConfig();
​
// if the pool balance is changing then check the outstanding loans
if (p.poolBalance != pools[poolId].poolBalance) {
require(
p.outstandingLoans == pools[poolId].outstandingLoans +
(p.poolBalance - pools[poolId].poolBalance),
"Can't change pool balance without changing outstanding loans"
);
}
​
// update the pool balance
pools[poolId].poolBalance = p.poolBalance;
​
...
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.