Vulnerability & Bug Fixes

src/InterestLib.sol

@@ -7,7 +7,7 @@ library InterestLib {
     uint256 public constant ONE = 10 ** 18;
     uint256 public constant ONE_THOUSAND_APY = 76_036_763_191;
 
-    function pow(uint256 _base, uint256 _exponent) public pure returns (uint256) {
+    function pow(uint256 _base, uint256 _exponent) internal pure returns (uint256) {
         if (_exponent == 0) {
             return ONE;
         } else if (_exponent % 2 == 0) {

src/PolyLend.sol

@@ -246,15 +246,15 @@ contract PolyLend is PolyLendEE, ERC1155TokenReceiver {
             loanAmount: loanAmount,
             rate: offers[_offerId].rate,
             startTime: block.timestamp,
-            minimumDuration: requests[_offerId].minimumDuration,
+            minimumDuration: requests[requestId].minimumDuration,
             callTime: 0
         });
 
         // invalidate the request
         requests[requestId].borrower = address(0);
 
         // invalidate the offer
-        offers[requestId].lender = address(0);
+        offers[_offerId].lender = address(0);
 
         // transfer the borrowers collateral to address(this)
         conditionalTokens.safeTransferFrom(msg.sender, address(this), positionId, collateralAmount, "");
@@ -362,7 +362,8 @@ contract PolyLend is PolyLendEE, ERC1155TokenReceiver {
             revert AuctionHasEnded();
         }
 
-        uint256 currentInterestRate = (block.timestamp - loans[_loanId].callTime) * MAX_INTEREST / AUCTION_DURATION;
+        // Fixed bug: add InterestLib.ONE to prevent interest going to 0 for early calls to transfer
+        uint256 currentInterestRate = InterestLib.ONE + ((block.timestamp - loans[_loanId].callTime) * (MAX_INTEREST - InterestLib.ONE) / AUCTION_DURATION);
 
         // _newRate must be less than or equal to the current offered rate
         if (_newRate > currentInterestRate) {

src/test/PolyLendTestHelper.sol

@@ -3,6 +3,7 @@ pragma solidity ^0.8.15;
 
 import {Test, console2 as console, stdStorage, StdStorage, stdError} from "../../lib/forge-std/src/Test.sol";
 import {PolyLend, PolyLendEE, Loan, Request, Offer} from "../PolyLend.sol";
+import {InterestLib} from "../InterestLib.sol";
 import {USDC} from "../dev/USDC.sol";
 import {DeployLib} from "../dev/DeployLib.sol";
 import {IConditionalTokens} from "../interfaces/IConditionalTokens.sol";
@@ -101,6 +102,7 @@ contract PolyLendTestHelper is Test, PolyLendEE {
     }
 
     function _getNewRate(uint256 _callTime) internal view returns (uint256) {
-        return (block.timestamp - _callTime) * polyLend.MAX_INTEREST() / polyLend.AUCTION_DURATION();
+        //return (block.timestamp - _callTime) * polyLend.MAX_INTEREST() / polyLend.AUCTION_DURATION();
+        return InterestLib.ONE + ((block.timestamp - _callTime) * (polyLend.MAX_INTEREST() - InterestLib.ONE) / polyLend.AUCTION_DURATION());
     }
 }