Beedle - Oracle free perpetual lending

Summary

Pool balance doesn't updated

Vulnerability Details

In this section of the code, there is a problem related to the pool balance update between lines 150 and 163. When the user calls the setPool function for adding a new pool with a certain amount of p.poolBalance, it calls the IERC20(p.loanToken).transferFrom(...) function to transfer funds. However, there is no subsequent update for poolBalance through the _updatePoolBalance(...) call. This leads to a situation where a new pool is created, but its poolBalance remains 0, causing the condition if (debt > pool.poolBalance) revert LoanTooLarge(); (Line 243) to be triggered. Consequently, borrowers cannot borrow assets from that pool due to this condition, and it creates an issue.

Moreover, when the emitted event PoolBalanceUpdated is caught by the backend and the addToPool(...) function is called, the user ends up paying twice for the transaction.

To resolve these issues, the code needs to be updated to ensure that the poolBalance is properly updated after the initial transfer of funds in the setPool function.

Impact

User will pay twice or will pay once and as a result will not have working pool.

Tools Used

Manual

Recommendations

I will recommend to update poolBalance in these 2 cases`
if (p.poolBalance > currentBalance) {
...
_updatePoolBalance(...);
} else if (p.poolBalance < currentBalance) {
...
_updatePoolBalance(...);
}