yixxas - Lender cannot choose the exact amount of duration they allow Borrower to extend the loan by

[github-actions]

yixxas

high

Lender cannot choose the exact amount of duration they allow Borrower to extend the loan by

Summary

Rolling of a loan happens in multiples of req.duration. Lender can allow or disallow Borrower to roll their loan by calling toggleRoll() but they cannot control the amount of duration in which Borrower can roll it by.

Vulnerability Detail

The issue here is due to how there is no limits to the number of times roll() can be called. Each call to it will increase the expiry of the loan by a 100% of the original loan duration. Borrower can extend it perpetually for as long as they have the required collateral to pay the additional increase in in amount due to interest.

Lender may want to allow Borrower to extend loan duration only up to some number of weeks/months but does not have an option to do so.

Impact

Lender may for example originally agree with Borrower to enter a loan agreement of 1 years. Borrower is unable to pay back within this timespan and request for Lender to extend it by another year. However, Lender has to trust that Borrower only roll() for a year and not many times more than that. This puts Lender at a severe disadvantage in this P2P protocol.

Code Snippet

https://github.com/sherlock-audit/2023-01-cooler/blob/main/src/Cooler.sol#L129

Tool used

Manual Review

Recommendation

It is recommended that we change the implementation of roll(). roll() should only be callable once by Borrower but Borrower can choose the duration in which they want to extend it by, up to a maximum amount allowed by Lender when permission to roll() is granted.

If Borrower wants to extend the duration again, they can make another request to Lender. Logic for this can be handled in toggleRoll().

Duplicate of #215