Submitted by Koolex
SPL tokens are used as collateral in the protocol. On borrow, there is a transfer from the borrower into a PDA (position account). On repay, the other way around.
However, SPL token could have a freeze authority. Therefore, any account is vulnerable to be frozen. This could be harmful for both borrowers and lenders. I believe, The protocol should be resilient enough to not fall into such situations where the funds are locked and borrowing or repaying are DoSed.
There is no check for freeze authority of the mint (i.e. token).
More info on freeze authority feature:
SPL Token#freezing-accounts
Ensure the collateral token does not have an active freeze_authority. If the freeze_authority was set to None, then freezing feature can never work again.
Access Control
piske-alex (Lavarage) confirmed
alcueca (judge) commented:
