Beedle - Oracle free perpetual lending

Summary

If the pool balance is smaller than the amount planned to remove from the pool, the transaction will revert.

Vulnerability Details

In the function removeFromPool() on Lender.sol user is passing as parameter uint256 amount, which is then subtracted from the pool balance in the operation:

The problem is that there is no check to validate that the poolBalance of the specified pool is bigger than the requested amount to remove.

Impact

The transaction will revert unexpectedly for underflow if this situation happens.

Tools Used

None

Recommendations

Add a validation before updating the balance:

if (pools[poolId].poolBalance > amount) revert NotEnoughAmountInPool();