Beanstalk Part 1

Summary

The switchUnderlyingToken function within the LibUnripe library lacks a required check to ensure that s.u[unripeToken].balanceOfUnderlying is zero before allowing the underlying token to be switched. This omission could potentially lead to misuse of the function and violate the main invariant.

Impact

The absence of this check increases the risk of unintended behavior and could result in inconsistencies within the application's state. Developers or users may inadvertently call the function without ensuring that the balance of the underlying token is zero, which can lead to unexpected outcomes and compromise the integrity of the system.

PoC

The InitMigrateUnripeBean3CrvToBeanEth.sol[https://github.com/Cyfrin/2024-02-Beanstalk-1/blob/a3658861af8f5126224718af494d02352fbb3ea5/protocol/contracts/beanstalk/init/InitMigrateUnripeBean3CrvToBeanEth.sol#L22-L33] file calls LibUnripe.switchUnderlyingToken(C.UNRIPE_LP, C.BEAN_ETH_WELL); without the required check, despite being out of scope, potentially leading to unintended consequences.

Recommendations

It is recommended to add a require statement within the switchUnderlyingToken function to enforce the condition that s.u[unripeToken].balanceOfUnderlying must be zero before proceeding with the switch.

E.g new code should look like this: