evilakela - Lender can roll loan with arbitrary terms

[sherlock-admin2]

evilakela

high

Lender can roll loan with arbitrary terms

Summary

Lender can provideNewTermsForRoll and then rollLoan with these terms because it permissionless.

Vulnerability Detail

Basicly it allow lender to arbitrary set interest, LTC and duration - increase debt as he wants. This may require to pledge additional collateral (or may not if decrease LTC), but if debt increase is huge, borrower won't repay and anyway lose collateral.
Attack path:

1. lender clears loan
2. calls provideNewTermsForRoll with huge interest rate to drascticly increase debt, small duration and smaller ltc to not provide additional collateral
3. calls rollLoan
4. now borrowers forced to lose collateral or pay huge debt

Impact

Lender arbitrary increase loan debt. Borrower lose collateral if don't repay.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L192-L217
https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L282-L300

Tool used

Manual Review

Recommendation

Make rollLoan callable only by borrower (and maybe trusted party like Clearinghouse)

Duplicate of #26