evilakela - rollLoan can be frontrunned by lender to set arbitrary terms

[sherlock-admin]

evilakela

high

rollLoan can be frontrunned by lender to set arbitrary terms

Summary

Lender can frontrun rollLoan called by borrower with provideNewTermsForRoll and change loan terms.

Vulnerability Detail

Basicly same scenario as in my other finding: "Lender can roll loan with arbitrary terms", but not because rollLoan is permissionless.
Attack path

1. lender provide good new terms
2. borrower see it and decided to roll loan, he sends tx
3. lender see it and calls provideNewTermsForRoll with higher gas fee
4. if lender's tx executed before, borrower will roll loan with new terms, not what he thought

Impact

Lender arbitrary increase loan debt. Borrower lose collateral if don't repay.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L192-L217

Tool used

Manual Review

Recommendation

Allow borrower to directly provide new loan terms: rollLoan(interest, LTC, duration) and then check if it matches loan.request set by lender.

Duplicate of #243