Beedle - Oracle free perpetual lending

Vulnerability Details

Certain tokens (e.g., STA or PAXG) charge a fee for transfers and others (e.g., USDT or USDC) may start doing so in the future. This is not correctly handled in multiple places and would lead to a loss of funds.

POC & Impact

1. addToPool() and removeFromPool() can be reverted when a user borrows a loan, or the lender withdraws the loan from the pool as there are less tokens being transferred to the pool than the actual poolBalance of that pool.

2. borrow() and refinance() update the poolBalance accordingly to the amount which the borrower puts in, but the actual transferred loanToken or collateralToken amount will be less when giving from the pool to the borrower or from the borrower to the pool.

Tools Used

Manual

Recommendations

When fee-on-transfer tokens should be supported, you need to check the actual balance differences. If they are not supported, this should be clearly documented.