deadrxsezzz - If new terms reduce collateral ratio, no collateral is refunded

[sherlock-admin]

deadrxsezzz

medium

If new terms reduce collateral ratio, no collateral is refunded

Summary

If new terms reduce collateral ratio, no collateral is refunded

Vulnerability Detail

After a loan is active, the lender can propose new terms for it, which the borrower can then accepted. The problem is that if the new terms are accepted and collateralRatio is reduced enough so the needed collateral is less than what it was originally, no collateral is then refunded to the user, although it should be.

    function newCollateralFor(uint256 loanID_) public view returns (uint256) {
        Loan memory loan = loans[loanID_];
        // Accounts for all outstanding debt (borrowed amount + interest).
        uint256 neededCollateral = collateralFor(
            loan.amount,
            loan.request.loanToCollateral
        );

        return
            neededCollateral > loan.collateral ?
            neededCollateral - loan.collateral :
            0;
    }

It only checks if neededCollateral is more and new collateral should be deposited.

Impact

User isn't refunded their collateral when they should be.

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L282C1-L300C6

Tool used

Manual Review

Recommendation

If the new collateral ratio is less than what it was originally, refund the needed part of the collateral to the user

Duplicate of #26