Beedle - Oracle free perpetual lending

Summary

The return values of an external transfer/transferFrom calls in functions sellProfits(Fees.sol), setPool, addToPool, removeFromPool, borrow, repay, giveLoan, buyLoan, seizeLoan, refinance (Lender.sol) and deposit, withdraw and claim in Staking.sol are not checked.

Vulnerability Details

When using the functions transfer/transferFrom, it's crucial to check their return value to ensure that the transfer was successful. If the return value is not checked and the function fails, the contract might continue executing as if the transfer was successful, which can lead to unexpected behavior.

Impact

If the transfer or transferFrom function fails for any reason, the contracts will not be aware of it.

Tools Used

Manual review

Recommendations

Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.