Beanstalk Part 1

Summary

The gm function in the SeasonFacet contract advances the protocol to the next season based on a fixed and predictable season length. This predictability can be exploited by traders to engage in arbitrage, potentially leading to price manipulation of the Bean asset.

Vulnerability Details

The function gm allows users to trigger a new season once the current season has concluded, as determined by the seasonTime() function. Since the season's end is predictable, traders could prepare strategies to buy or sell large quantities of Beans or related assets just before a season ends, and then reverse these trades immediately after the new season begins, exploiting the price discrepancies that may arise due to the change in season.

Impact

If not addressed, the issue could lead to systematic price manipulation, which may result in unfair trading advantages, loss of trust in the protocol's price stability, and potential harm to the protocol's reputation and long-term viability. It is recommended to address this issue to ensure a fair and robust economic

Tools Used

Manual review

Recommendations

1. Randomize the exact time of season transitions within a certain range to make it less predictable.

2. Introduce a threshold mechanism that requires additional conditions to be met before a season can transition.

3. Employ an algorithmic approach to adjust the season length based on on-chain activity to prevent traders from being able to predict season changes accurately.