Debt gets subtracted twice when refinancing a loan

[codehawks-bot]

Debt gets subtracted twice when refinancing a loan

Severity

High Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L698

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L636

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L698

Summary

The debt of the loan at hand gets subtracted twice when refinancing it through refinance().

Vulnerability Details

Lender.sol's refinance() subtracts debt from the pool balance twice, which will lock another debt amount's worth of tokens in the new pool.

function refinance(Refinance[] calldata refinances) public {
        for (uint256 i = 0; i < refinances.length; i++) {
						...
           
			// update the old lenders pool
            _updatePoolBalance(
                oldPoolId,
                pools[oldPoolId].poolBalance + loan.debt + lenderInterest
            );

            pools[oldPoolId].outstandingLoans -= loan.debt;

            // @audit deducting from the balance #1
            _updatePoolBalance(poolId, pools[poolId].poolBalance - debt);
            pools[poolId].outstandingLoans += debt;
   
						...
			
            // @audit deducting from the balance #2
            pools[poolId].poolBalance -= debt;
	          
						...
        }
    }

Impact

It will lock debt * 2 worth of tokens in the new pool.

Tools Used

Manual Review

Recommendations

Consider removing the following line: https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L698