enckrish - ClearingHouse.maxDuration can be easily bypassed

[github-actions]

enckrish

medium

ClearingHouse.maxDuration can be easily bypassed

Summary

ClearingHouse.clear enforces a maxDuration for loan requests. In practice, the loan owner can easily bypass this limit by calling Cooler.roll as many times as needed.

Vulnerability Detail

The loan request can be made with a duration less than the maxDuration. ClearingHouse.clear calls Cooler.clear which sets true for Loan.rollable. The owner thus is now able to extend the loan term as much as he wants.

Impact

Loan owners are able to bypass the maxDuration restriction in ClearingHouse.

Code Snippet

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/aux/ClearingHouse.sol#L58-L86

Tool used

Manual Review

Recommendation

In ClearingHouse.clear, call Cooler.toggleRoll just after the Cooler.clear call.

Duplicate of #215