deadrxsezzz - If a lender has made a request and gives the loan to a new lender, the borrower can still accept the original lender's proposed terms

[sherlock-admin2]

deadrxsezzz

high

If a lender has made a request and gives the loan to a new lender, the borrower can still accept the original lender's proposed terms

Summary

If a lender has made a request and gives the loan to a new lender, the borrower can still accept the original lender's proposed terms

Vulnerability Detail

After a loan is active, the lender can propose new terms for it via provideNewTermsForRoll.

   function provideNewTermsForRoll(
        uint256 loanID_,
        uint256 interest_,
        uint256 loanToCollateral_,
        uint256 duration_
    ) external {
        Loan storage loan = loans[loanID_];

        if (msg.sender != loan.lender) revert OnlyApproved();

        loan.request =
            Request(
                loan.amount,
                interest_,
                loanToCollateral_,
                duration_,
                true
            );
    }

The lender can also transfer ownership of the loan to a new lender. The problem is that upon doing so, the requests for the loan are not cleared. This means that after transferring the ownership, the borrower can still accept the terms from the original lender, even if the new one finds them unfavorable.

Impact

New lender can be forced into unfavorable loan terms.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L282C2-L300C6

Tool used

Manual Review

Recommendation

Upon transferring ownership of a loan, clear all requests for it.

Duplicate of #26