Beanstalk Part 1

Summary:

The UnwrapAndSendETH contract, designed to facilitate the unwrapping of Wrapped Ether (WETH) and sending the unwrapped Ether (ETH) to a specified address, contains a vulnerability due to an unprotected external call. This vulnerability could potentially allow an attacker to exploit the contract's functionality, leading to unintended behavior or loss of funds.

Vulnerability Details:

1. Deploy the UnwrapAndSendETH contract with the address of the WETH contract.

2. Load WETH into the UnwrapAndSendETH contract.

3. Call the unwrapAndSendETH function with the address of an attacker's contract that has a fallback function designed to call unwrapAndSendETH again.

Proof of Concept (POC) Script:

Output:

Upon executing the POC script, the Attack contract successfully drains the UnwrapAndSendETH contract's ETH balance through a reentrancy attack.

Impact:

This vulnerability could allow an attacker to drain the UnwrapAndSendETH contract's ETH balance, leading to loss of funds for the contract's users. It also demonstrates a potential security flaw in the contract's design, which could be exploited in more complex scenarios.

Recommendations:

To mitigate this vulnerability, the UnwrapAndSendETH contract should implement a reentrancy guard to prevent recursive calls. Additionally, it's crucial to validate all external addresses to which ETH is being transferred, including checking for the zero address.

Here's a revised version of the unwrapAndSendETH function with a basic reentrancy guard and address validation:

This fix introduces a locked state variable to prevent reentrancy and checks that the recipient address is not the zero address. These changes help to secure the contract against the identified vulnerability.