james_wu - provideNewTermsForRoll front-runnable

[sherlock-admin2]

james_wu

high

provideNewTermsForRoll front-runnable

Summary

provideNewTermsForRoll front-runnable by malicious lender

Vulnerability Detail

provideNewTermsForRoll front-runnable by malicious lender just before borrower calls rollLoan.
Bad Lender can set high-debt arguments, so that borrower send much collateral than expected.

Impact

borrower send much collateral than expected

Code Snippet

https://github.com/sherlock-audit/2023-08-cooler/blob/main/Cooler/src/Cooler.sol#L282-L301

    function provideNewTermsForRoll(
        uint256 loanID_,
        uint256 interest_,
        uint256 loanToCollateral_,
        uint256 duration_
    ) external {
        Loan storage loan = loans[loanID_];

        if (msg.sender != loan.lender) revert OnlyApproved();

        loan.request =
            Request(
                loan.amount,
                interest_,
                loanToCollateral_,
                duration_,
                true
            );
    }

Tool used

Manual Review

Recommendation

Make lender not able to provide new term if already has request.

Duplicate of #243