Summary

With the token address as an input, no verification if the inputted token is an unripe token held by the user.

Vulnerability Details

Due to the possibility of multiple unripeTokens can be held in the unripeFacet contract with different underlying tokens, a user with a particular unripeToken can input the address of another unripeToken with a different underlying token and withdraw that instead as there is no verification of the balance of the user unripeToken.

Impact

• Arbitrage opportunity to steal a different token and more or less than deserved rewards.

• Unfairness for other users as high value or popular underlying tokens attached to an unripeToken can be withdrawn, causing loss to some users

Tools Used

Manual Review

Recommendations

Add verification for unripeToken to verify balance matches the token inputted like