Beanstalk Part 1

Summary

UnwrapAndSendETH contract allows for the withdrawal of WETH tokens for any address calling the unwrapAndSendETH function. This design decision poses a potential risk if a user withdraws their balance to the contract and then another person front-runs it, taking advantage of the already withdrawn ETH balance.

Vulnerability Details

See the following code:

Impact

Allowing unrestricted withdrawal of WETH tokens can lead to potential front-running attacks, where malicious actors exploit the predictable behavior of transactions to their advantage. In this scenario, a user may initiate a transaction to withdraw their WETH balance to the contract, and before this transaction is confirmed, another malicious actor observes the transaction in the mempool and quickly initiates a transaction to withdraw the already withdrawn ETH balance, effectively stealing the funds.

Tools Used

Manual Review

Recommendations

To mitigate the risk of front-running attacks and ensure the security of the contract, consider implementing the following solutions:

Limit the ability to withdraw WETH tokens to only specific addresses or authorized users. This could involve implementing access control mechanisms such as only allowing withdrawal to predefined whitelisted addresses.

Implement time-lock mechanisms to delay the withdrawal of ETH funds after the WETH tokens are unwrapped. By introducing a delay between unwrapping WETH and sending ETH, the contract can prevent immediate front-running attacks by allowing time for transactions to be processed.

Ensure that the contract is protected against re-entrancy attacks by following best practices such as using the checks-effects-interactions pattern and properly handling state changes before interacting with external contracts.