Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`UnwrapAndSendETH::unwrapAndSendETH` lacking access control creates a dangerous situation

inallhonesty

Summary

The only method in the junction contract UnwrapAndSendETH can be called externally, by anyone, creating the risk of unaware users to lose their ETH tokens.

Vulnerability Details

Junctions are helper contracts that can be used in a pipeline call to unlock greater functionality. Even if these should be called only through the Pipeline contract there's nothing stopping anyone to use them directly.
If someone interacts with the contract by directly transferring WETH to it and then attempting to call unwrapAndSendETH they would 100% be frontran and have their unwrapped ETH stolen by MEV bots.

Impact

Likelihood - Low, a user would have to directly interact with the contract.
Impact - High, all his funds will be lost.

Tools Used

Manual review

Recommendations

Given that the intended way of calling this is through the Pipeline contract why not implement an onlyPipeline modifier to limit the access of anyone else like so:

contract UnwrapAndSendETH {
receive() external payable {}
​
address public immutable WETH;
++ address public pipeline;
​
constructor(address wethAddress, address _pipeline) {
WETH = wethAddress;
++ pipeline = _pipeline;
​
}
​
++ modifier onlyPipeline {
++ require(msg.sender == pipeline, "Unauthorized access");
++ _;
++}
​
​
/// @notice Unwrap WETH and send ETH to the specified address
/// @dev Make sure to load WETH into this contract before calling this function
-- function unwrapAndSendETH(address to) external {
++ function unwrapAndSendETH(address to) external onlyPipeline {
uint256 wethBalance = IWETH(WETH).balanceOf(address(this));
require(wethBalance > 0, "Insufficient WETH");
IWETH(WETH).withdraw(wethBalance);
(bool success, ) = to.call{value: address(this).balance}(
new bytes(0)
);
require(success, "Eth transfer Failed.");
}
}
Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Pipeline access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.