ubl4nk - rollLoan is vulnerable to front-running

[sherlock-admin]

ubl4nk

high

rollLoan is vulnerable to front-running

Summary

A malicious lender is able to front-run rollLoan and increases debt amount.

Vulnerability Detail

• Lender provides new terms for rolling over the loan.
• Borrower accepts and calls rollLoan.
• Lender front-runs the borrower transaction and calls provideNewTermsForRoll with new terms (for example he sets a higher number for interest which leads to higher debt amount for borrower).

Impact

Borrower may pay more collateral and repay as much as lender ask.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/6d34cd12a2a15d2c92307d44782d6eae1474ab25/Cooler/src/Cooler.sol#L282-L300
https://github.com/sherlock-audit/2023-08-cooler/blob/6d34cd12a2a15d2c92307d44782d6eae1474ab25/Cooler/src/Cooler.sol#L192-L217

Tool used

Manual Review

Recommendation

Duplicate of #243