Centralization risk as contract owner can DoS major methods and lead to lost/stuck funds.
Summary
Owner of the Lender.sol contract can indefinitely stuck all funds active in a loan. (collateral + debt)
Vulnerability Details
The owner of Lender.sol can set feeReceiver to address(0). Methods borrow, repay, giveLoan, buyLoan and seizeLoan all make a erc20 transfer to feeReceiver. Since most tokens revert on transactions to address(0), all of the mentioned methods will revert. Users will be unable to repay their loans and collateral would also be impossible to be recovered.
Impact
Centralization risk. Malicious or compromised protocol owner can DoS all major methods within the contract and lead to stuck/ lost funds.
Tools Used
Manual review
Recommendations
Implement a pull-over-push method for the feeReceiver.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.