Reentrancy in removeCollateral() / requestLoan()

Lines of code Vulnerability details Impact There is a potential reentrancy bug they may exist between requestLoan and removeCollateral that allows a user to have requested a loan while maintaining ownership of the collateral. This bug is present in both NFTPair and NFTPairWithOracle. The reentran...

Use Victims Collateral by Frontrunning

Lines of code Vulnerability details Issue: the require statement in requestLoan doesn't check if the one that provides the collateral is the same address that requests the loan Consequences: If an NFT is transferred to the contract by itself, either on accident or preparing to call requestLoan wi...

Users Who approve() ERC20 Tokens for NFTPair of NFTPairWithOracle Contracts May Have Their Allowances Stole By Any User

Lines of code Vulnerability details Impact User's who approve ERC20 or any other token type excluding the collateral token may have their balances stolen by any user. The ACTIONCALL allows users to call any function on any smart contract excluding this, collateral and bentoBox. Thus, if any user...

Lender can unconditionally liquidate borrower by changing ltvBPS to 0

Lines of code Vulnerability details Impact In NFTPairWithOracle.updateLoanParams, a lender is allowed to decrease ltvBPS. If the lender set it to 0, he can call removeCollateral immediately to liquidate the borrower. Proof of Concept function updateLoanParamsuint256 tokenId, TokenLoanParams memor...

Reentrancy at _requestLoan allows requesting a loan without supplying collateral

Lines of code Vulnerability details requestLoan makes an external call to the collateral contract before updating the NFTPair contract state. Impact If the ERC721 collateral has a afterTokenTransfer hook, The NFTPair contract can be reentered, and a loan can be requested without the borrower...