Submitted by WatchPug
MapleLoan.sol L56-L63
Based on the context, we believe that the closeLoan() should only be called by the borrower. However, the current implementation allows anyone to call closeLoan() anytime after fundLoan().
If there is no earlyFee, this enables a griefing attack, causing the borrower and lender to abandon this contract and redo everything which costs more gas.
If a platform fee exits, the lender will also suffer fund loss from the platform fee charged in fundLoan().
Change to:
deluca-mike (Maple) confirmed:
pauliax (judge) commented:
