Beedle - Oracle free perpetual lending

Summary

The contract uses a hardcoded value of decimals (1e18) for ERC20 tokens, which can lead to wrong calculations and loss of funds.

Vulnerability Details

Function borrow calculates loanRatio by using hardcoded value of decimals 18 (1e18) for ERC20tokens. This leads to wrong calculations and effectively loss of funds for all pools that will be using ERC20 tokens with different decimals than 18. Example of such a token is USDC that has 6 decimals only.

Another instance of the same calculation is here.

Impact

Can lead to wrong calculations and loss of funds if the loanToken or collateral token has decimals not equal to 18.

Tools Used

Manual review.

Recommendations

It is recommended to add support for different number of decimals than 18 by dynamically checking decimals() for the tokens that are part of the calculations. Alternatively if such a support is not needed, new require statements should be added to the function that will be checking that the number of decimals for all ERC20 tokens is 18.