HollaDieWaldfee - Cooler: roll function should set loan.rollable to false when called

[github-actions]

HollaDieWaldfee

medium

Cooler: roll function should set loan.rollable to false when called

Summary

The Cooler.roll function allows the borrower of a loan to extend the loan for another duration.
By doing this the debt is increased and the borrower must provide additional collateral.

The issue with this is that the borrower can extend the loan for as many durations as he wants.
The rollable attribute is not set to false when the function is called.

Vulnerability Detail

The lender might grant the borrower a loan with a 3% interest rate which can be a reasonable interest rate for a loan with a duration of one year.
However the borrower can roll the loan for as many durations as he wants.

This is a problem since the economic incentives are such that longer loan durations should require the borrower to pay higher interest rates. This is because the lender loses access to his money for a longer period of time and the longer the duration the higher the risk of default.

The borrower should not have to pay only 3% interest per year for a loan with duration of say 10 years. The interest rate should be a lot higher.

Impact

So the borrower can extend a loan which is meant for a short duration for as long as he wants with the low interest rates that are only sensible for the shorter duration.

Code Snippet

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/Cooler.sol#L129-L147

Tool used

Manual Review

Recommendation

The Cooler.roll function should set rollable to false such that the borrower can only extend the loan for one additional period. If he wants to extend the loan for longer, the lender must consent to this again.

Fix:

diff --git a/src/Cooler.sol b/src/Cooler.sol
index 92158d3..2e97f43 100644
--- a/src/Cooler.sol
+++ b/src/Cooler.sol
@@ -142,6 +142,7 @@ contract Cooler {
         loan.amount += newDebt;
         loan.expiry += req.duration;
         loan.collateral += newCollateral;
+        loan.rollable = false;
         
         collateral.transferFrom(msg.sender, address(this), newCollateral);
     }

Duplicate of #215