Beedle - Oracle free perpetual lending

Summary

when lender start an auction, borrower can call this function to make auction start failed.

Vulnerability Details

Lender can start auction by calling startAuction function with change loans[loanId].auctionStartTimestamp to type(uint256).max, after that, borrowers still can change loans[loanId].auctionStartTimestamp to default value type(uint256).max by calling refinance function, which means borrower can make lender start an auction failed. Malicious borrower can monitor the AuctionStart event and send an refinance tx to make the lender start auction failed.

Impact

Borrower can make lender start an auction failed with refinance function.

Tools Used

vscode, Manual Review

Recommendations

Add condition in refinance to avoid borrower can change loans[loanId].auctionStartTimestamp to type(uint256).max if loans[loanId].auctionStartTimestamp already be set by lender.