Beanstalk Part 1

Summary

LibConvertData functions decode input data expecting three arguments (amountIn, minAmountOut, and an optional address), but they do not check the length of the input data to ensure it is correct.

Vulnerability Details

Check abi.decode(...) in all the functions of LibConvertData

Impact

if the input data does not match the expected length. This can lead to runtime errors.

Tools Used

Manual Review

Recommendations

Add validations in each function i.e For basicConvert validation should be require(self.length == 64, "Invalid input length");

For convertWithAddress validation should be require(self.length == 96, "Invalid input length");