Consent in MutualConsent is not removable

[code423n4]

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/audit/code4rena-2022-11-03/contracts/utils/MutualConsent.sol#L38-L60
https://github.com/debtdao/Line-of-Credit/blob/audit/code4rena-2022-11-03/contracts/utils/MutualConsent.sol#L31-L36

Vulnerability details

Impact

Borrower or Lender can't remove their consent from MutualConsent if they need.

Proof of Concept

MutualConsent has mutualConsent modifier which is used to protect functions that need to have consent of 2 parties before call. Example of such function is LineOfCredit.addCredit.

This is how mutual consent checking works
https://github.com/debtdao/Line-of-Credit/blob/audit/code4rena-2022-11-03/contracts/utils/MutualConsent.sol#L38-L60

    function _mutualConsent(address _signerOne, address _signerTwo) internal returns(bool) {
        if(msg.sender != _signerOne && msg.sender != _signerTwo) { revert Unauthorized(); }


        address nonCaller = _getNonCaller(_signerOne, _signerTwo);


        // The consent hash is defined by the hash of the transaction call data and sender of msg,
        // which uniquely identifies the function, arguments, and sender.
        bytes32 expectedHash = keccak256(abi.encodePacked(msg.data, nonCaller));


        if (!mutualConsents[expectedHash]) {
            bytes32 newHash = keccak256(abi.encodePacked(msg.data, msg.sender));


            mutualConsents[newHash] = true;


            emit MutualConsentRegistered(newHash);


            return false;
        }


        delete mutualConsents[expectedHash];


        return true;
    }

As you can see the function store consent of first caller and then waits when another caller will call same function.
There is no any ability to remove this contest.

How this can be used?
For example at t1 lender and borrower aggreed on some credit for amount of tokens and specific fee rates. Then borrower calls createCredit and his consent is stored.
But lender do not call createCredit.
After some time smth happened and rates changed, so it's not good credit conditions for a borrower anymore, but very good for lender.
And lender calls createCredit. As borrower consent already stored, this credit will be created and fees will start accumulate.

Tools Used

VsCode

Recommended Mitigation Steps

Add ability to remove consent, or think about some expiration time for consents.

[c4-judge]

dmvt marked the issue as duplicate of #33

[c4-judge]

dmvt marked the issue as satisfactory