Beanstalk Part 1

Vulnerability Details

The convert function allows users to convert one type of deposit into another by interacting with external token contracts. If an attacker can cause the convert function to interact with a token contract that is designed to always fail (for example, by reverting on token transfers), they could prevent legitimate conversions from being processed.

Impact

1. Legitimate users would be unable to perform conversions, disrupting the normal operation of the contract.

2. The inability to convert tokens could lead to economic imbalances within the protocol

Tools Used

Manual Review

Recommendations

1. introduce checks to ensure that only legitimate and verified token contracts can be interacted with during the conversion process.

2. Maintain a whitelist of approved token contracts that are allowed to participate in the conversion process. This list should be managed by a trusted party or governance process and should include only contracts that have been audited and deemed secure.