Submission Details
Severity:
buyLoan() doesn't check if caller is the pool owner
Summary
Caller not being the owner of the pool can cause issues
Vulnerability Details
In buyLoan() of Lender.sol it should be called by the owner of the pool or the lender but it doesnt check if the calleris the pool.lender.
Impact
Can lead to pools buying loans they don't want to.
Tools Used
Manual review
Recommendations
Perform check if (msg.sender == pool.lender)
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.