Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

UnwrapAndSendETH::unwrapAndSendETH anyone can call this functions and withdraw all the Amount ether from contract

touqeershah32

Summary

This UnwrapAndSendETH::unwrapAndSendETH have no access control and didn't check who deposit token or ether allow any one to call and withdraw all the fund store in this token.

Vulnerability Details

If you see the contract function any one can deposit small amount of weth and transfer all the ether and with from token no matter who deposit it, also front run

let suppose person A send some token and Attacker found it transaction and before he can withdraw he front run the transaction and get all the amount transfer to his account.

/// @notice Unwrap WETH and send ETH to the specified address
/// @dev Make sure to load WETH into this contract before calling this function
function unwrapAndSendETH(address to) external {
uint256 wethBalance = IWETH(WETH).balanceOf(address(this));
require(wethBalance > 0, "Insufficient WETH");
IWETH(WETH).withdraw(wethBalance);
(bool success, ) = to.call{value: address(this).balance}(
new bytes(0)
);
require(success, "Eth transfer Failed.");
}

Impact

Lose of Funds

Tools Used

Manual Review

Recommendations

Access access control or check who deposit the amount , so that can withdraw the amount from contract

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Pipeline access control

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.