Beedle - Oracle free perpetual lending

Summary

In function giveLoan, contained within contract Lender.sol, the input parameters are two arrays. It is not checked that the two arrays have the same length.

Vulnerability Details

Function giveLoan receives two arrays as inputs. These arrays go through a for loop. It uses the length of one of the arrays to determine the number of iterations of the loop (i.e. loanIds.length):

function giveLoan(uint256[] calldata loanIds, bytes32[] calldata poolIds) external {
    for (uint256 i = 0; i < loanIds.length; i++) {
        uint256 loanId = loanIds[i];
        bytes32 poolId = poolIds[i]; //@audit check loanIds.length == poolIds.length

If loanIds length is not equal to poolIds length, it will revert

Impact

If loanIds length is not equal to poolIds length, it will revert

Tools Used

Manual review

Recommendations

Check both arrays have the same length:

require(loanIds.length == poolIds.length, "Arrays have different length");