Beedle - Oracle free perpetual lending

Summary

Some tokens (e.g. LEND) revert when transferring a zero value amount. If the borrow fee will be set to 0 (e.g. at the beginning of protocol life-cycle) users cannot borrow from pool with that kind of token.

Vulnerability Details

The lender can create a pool consisting of any arbitrary tokens. The user can then request to borrow from this pool. The borrow function calculates the fees that need to be paid for a loan and sends these fees to feeReceiver address. If the borrower would like to get a loan from a pool where the loanToken is a token that reverts when transferring a zero value amount, and the borrower fee was set to 0 (owner called setBorrowerFee function providing 0 as an argument), the function will revert.

Impact

Users may not be able to get a loan from pool.

Tools Used

Manual review.

Recommendations

Do not allow to set borrower fee as 0.