Adversary can utilize a large number of their own loans to cheat other lenders out of interest
The minimal interest paid by a loan is scaled by the number of provisions that make up the loan. By inflating the number of provisions with their own provisions then can cause legitimate lenders to receive a much lower interest rate than intended.\\nClaimFacet.sol#L94-L106\\n```\\nfunction sendInterests(Loan storage loan, Provision storage provision) internal returns (uint256 sent) {\\n    uint256 interests = loan.payment.paid - loan.lent;\\n    if (interests == loan.payment.minInterestsToRepay) {\\n        // this is the case if the loan is repaid shortly after issuance\\n        // each lender gets its minimal interest, as an anti ddos measure to spam offer\\n        sent = provision.amount + (interests / loan.nbOfPositions);\\n    } else {\\n        /* provision.amount / lent = share of the interests belonging to the lender. The parenthesis make the\\n        calculus in the order that maximizes precison */\\n        sent = provision.amount + (interests * (provision.amount)) / loan.lent;\\n    }\\n    loan.assetLent.checkedTransfer(msg.sender, sent);\\n}\\n```\\n\\nIf a loan is paid back before the minimal interest rate has been reached then each provision will receive the unweighted minimal interest amount. This can be abused to take loans that pay legitimate lenders a lower APR than expected, cheating them of their yield.\\nExample: A user wishes to borrow 1000 USDC at 10% APR. Assume the minimal interest per provision is 10 USDC and minimum borrow amount is 20 USDC. After 1 year the user would owe 100 USDC in interest. A user can abuse the minimum to pay legitimate lenders much lower than 10% APR. The attacker will find a legitimate offer to claim 820 USDC. This will create an offer for themselves and borrow 20 USDC from it 9 times. This creates a total of 10 provisions each owed a minimum of 10 USDC or 100 USDC total. Now after 1 year they owe 100 USDC on their loan and the repay the loan. Since 100 USDC is the minimum, each of the 10 provisions will get their minimal interest. 90 USDC will go to their provisions and 10 will go to the legitimate user who loaned them a majority of the USDC. Their APR is ~1.2% which is ~1/9th of what they specified.
The relative size of the provisions should be enforced so that one is not much larger than any other one
Legitimate users can be cheated out of interest owed
```\\nfunction sendInterests(Loan storage loan, Provision storage provision) internal returns (uint256 sent) {\\n    uint256 interests = loan.payment.paid - loan.lent;\\n    if (interests == loan.payment.minInterestsToRepay) {\\n        // this is the case if the loan is repaid shortly after issuance\\n        // each lender gets its minimal interest, as an anti ddos measure to spam offer\\n        sent = provision.amount + (interests / loan.nbOfPositions);\\n    } else {\\n        /* provision.amount / lent = share of the interests belonging to the lender. The parenthesis make the\\n        calculus in the order that maximizes precison */\\n        sent = provision.amount + (interests * (provision.amount)) / loan.lent;\\n    }\\n    loan.assetLent.checkedTransfer(msg.sender, sent);\\n}\\n```\\n