Beanstalk Part 1

Summary

Both sunrise and gm functions from SeasonFacet contract are flagged as payable, but without a withdraw functions there's a chance that funds might get stuck inside.

Vulnerability Details

These functions are flagged as payable because they might be used in a pipeline call where ETH is involved (for example, a transaction that calls sunrise -> sells bean to ETH -> transfers to another user). But any misconfiguration or partial swap inside the pipeline will result in dust/significant amounts stuck in the contract.

Impact

Likelihood is low because the conditions necessary for this to happen are not that common.

Impact is medium-low because the amounts won't necessarily be big.

Overall low severity.

Tools Used

Manual review

Recommendations

Implement a withdraw function that can save any ETH stuck inside the contract.