Beedle - Oracle free perpetual lending

Summary

The refinance() function for ERC777 tokens(extension of ERC20) is vulnerable to reentrancy, which can be exploited to drain the contract.

Vulnerability Details

1. Eve creates a pool by calling the setPool() function and set collateralToken as an ERC777 token.

2. Eve borrows 1 loan token from her pool.

3. Eve borrows 1 additional wei loan token from her pool and deposite a large amount of collateralToken tokens as collateral., increasing the outstandingLoans to 1e18 + 1.

4. Eve first calls the refinance() function for the second borrowing, setting refinances[i].debt and refinances[i].collateral to ZERO. Lender.sol then transfers collateralToken tokens to her contract. After that, she reenters the refinance() function to drain all of the collateralToken tokens.

Impact

Loss of user funds.

Tools Used

None

Recommendations

Do not allow reentrancy in this function.