Submission Details
Severity:
No checking if loan's tokens are matched with pool's tokens in buyLoan() function.
Summary
No checking if loan's tokens are matched with pool's tokens in buyLoan() function.
Vulnerability Details
There is no checking if loan's loanToken and collateralToken are matched or not with pool's ones.
It will make Lender.sol contract confusing, as well as buyer or seller will be dangerous.
Impact
It will make Lender.sol contract confusing, as well as buyer or seller will be dangerous.
Tools Used
Manual
Recommendations
Need to check if loan's tokens are matched with pool's ones.
function buyLoan(uint256 loanId, bytes32 poolId) public {
// get the loan info
...
if (pools[poolId].loanToken != loan.loanToken)
revert TokenMismatch();
if (pools[poolId].collateralToken != loan.collateralToken)
revert TokenMismatch();
...
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.