Submitted by WatchPug
MapleLoan.sol L86-L93
The current implementation allows anyone to call makePayment() and repay the loan with _drawableFunds.
This makes it possible for a malicious lender to call makePayment() multiple times right after fundLoan() and retrieve most of the funds back immediately, while then borrower must continue to make payments or lose the collateral.
Given:
Now, for the borrower 1,579 USDC is due, but only 96 USDC can be used. The borrower is now forced to pay the interests for the funds that never be used or lose the collateral.
Change to:
deluca-mike (Maple) confirmed:
pauliax (judge) commented:
