Beanstalk Part 1

Summary

The unwrapAndSendETH() function of the UnwrapAndSendETH contract has a flaw that allows any malicious user to steal ether belonging to users/the Beanstalk protocol at any time. The issue allows the contract's WETH balance to be drained.

Vulnerability Details

Looking at the code block above for unwrapping ether, we are sure of two things:

1. A user needs to have delegated a WETH balance to this contract. They could for example transfer WETH into this contract directly.

2. After having given this contract some WETH balance, they can specify the to address to send the underlying Ether to during the unwrapping process. This second step engineers an issue in the sense that any malicious frontrunner can watch the mempool for transactions that will result in this contract having a WETH balance, wait for that transaction to go through and immediately call the unwrapAndSendETH function in this contract to then take those underlying Ether.

We do not suppose atomic transactions consisting of a transfer and unwrapping of the transferred amount will be done via this contract. That would have mitigated the issue but nevertheless, it would still exist and some others would still lose as a result of not executing one such atomic transaction.

Impact

The resulting impact of this issue is a loss of the balance for this contract being held in WETH. The attacker can repeat this process for as long as the contract has a WETH balance effectively draining the balance every time.

Tools Used

Manual review + foundry

Recommendations

The recommendation for this is to rethink how the unwrap process should happen and who should be getting what. With this current implementation, one person can engineer a deposit that anyone else can take.