Beedle - Oracle free perpetual lending

Summary

1. Lenders can increase interest rates and shorten auction length by frontrunning the borrow() and refinance() functions.

2. Lenders can easily liquidate borrowers.

Vulnerability Details

1. Eve calls the setPool() function to creat a pool.

2. Bob borrows funds from Eve's pool by calling the borrow() function.

3. Eve frontruns by calling the setPool() function to set interestRate as MAX_INTEREST_RATE and auctionLength as 1 second.

4. Bob's transaction is excuated.

5. Eve initiates liquidation of Bob's position with the startAuction() function.

6. After 1 second, Eve seizes Bob's collateral with the seizeLoan() function.

Impact

Loss of user funds.

Tools Used

None

Recommendations

Include the interest rate and auction length in the Borrow and Refinance struct.