Borrowers can evade paying borrowing fees by splitting their loans into smaller ones

[codehawks-bot]

Borrowers can evade paying borrowing fees by splitting their loans into smaller ones

Severity

Medium Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol#L232

Summary

Segmenting loans of low-decimal tokens into smaller ones allows the borrower to not pay borrowerFee to the protocol.

Vulnerability Details

The fee calculation when borrowing looks like the following:

// debt * borrower fee(50) / 1e4
uint256 fees = (debt * borrowerFee) / 10000;

This presents an issue for the protocol when loans of low-decimal high-value tokens like WBTC are taken because they can segment their loan into smaller chunks, which are making the above formula round down to 0.

For this scenario to be economically profitable we need to assume that the fee savings in terms of fees not paid are higher than the additional gas needed to call borrow() with multiple borrows instead of with one. This assumption is not true at this moment but can become easily if such tokens' prices rise and the borrowerFee gets set to a lower number.

Impact

Eventually, users will be able to take loans without paying a borrower fee.

Tools Used

Manual Review

Recommendations

Consider adding a flat fee if fees rounds down to 0.

[PatrickAlphaC]

Not necessarily a security issue, but a good suggestion. I'll move to low for now, and sync with Beedle.