banditx0x - RollLoan can be called on someone else's loan giving them worse conditions or defaulting them in 1 block

[sherlock-admin]

banditx0x

high

RollLoan can be called on someone else's loan giving them worse conditions or defaulting them in 1 block

Summary

rollLoan can be called by any user even if they are not the borrower. A lender could set unfavorable loan conditions and then force the borrower to take them by calling rollLoan().

Vulnerability Detail

• rollLoan can be called by any user
• Lender could set the duration by calling function provideNewTermsForRoll(uint256 loanID_uint256 interest_uint256, , loanToCollateral_, 1)
• In the above call, _duration is set to 1, meaning the loan will be almost immediately default if accepted. They can also change the loanToCollateral and interest.
• Lender calls rollLoan. Since the collateral does not increase, this is free.
• Lender gets to default the loan and take the collateral.

Impact

• Roll loaner can be called on borrower without consent
• Lender can force loaner to accept unfair loan terms
• Lender can cause 1 second default of loan to gain unfair profit.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L192C25-L217

Tool used

Manual Review

Recommendation

Add a borrower to the loan struct and then check that loan.borrower = msg.sender

Duplicate of #26