Beanstalk Part 1

Summary

The enrootDeposits function processes an array of stems and corresponding amounts to update the Bean Denominated Value (BDV) of unripe deposits. It is observed that the function does not implement a check for duplicate stem entries within the input array. As a result, if the function is called with duplicate stem values, it attempts to remove the specified amounts for each occurrence of the stem, potentially leading to multiple removals of the same deposit.

Impact

If an account does not have sufficient balance to cover the removal of duplicate stems, the transaction will revert, leading to a failed operation and loss of gas for the user.

Tools Used

manual review

Recommendations

1. Implement a check to ensure that the array of stems does not contain duplicates before processing removals.

2. Use a data structure that inherently prevents duplication, such as a set, or ensure that the input is sanitized before being passed to the enrootDeposits function.