Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

User can buy a loan on behalf of another pool.

deadrosesxyz

Summary

A user can buy a loan on behalf of another pool.

Vulnerability Details

Upon calling buyLoan, the user specifies on behalf of which pool the loan to be bought of. The problem is that there isn't a check that msg.sender is the pool.lender and loan.lender is set to msg.sender instead of pool.lender

// update the loan with the new info
loans[loanId].lender = msg.sender;
loans[loanId].interestRate = pools[poolId].interestRate;
loans[loanId].startTimestamp = block.timestamp;
loans[loanId].auctionStartTimestamp = type(uint256).max;
loans[loanId].debt = totalDebt;

What a user can do to profit is the following:

  1. Find a auctioned loan.

  2. Call buyLoan with another lender's suitable poolId.

  3. Now that loan.lender is the malicious user, they can find a suitable pool to giveLoan to it.

  4. By doing so they'll be credited funds to their own pool.

  5. The user can then withdraw the funds

Impact

User can steal funds from other pools.

Tools Used

Manual review

Recommendations

Add a check that msg.sender == pool.lender

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!