Beanstalk Part 1

Vulnerability Details

The convert function is designed to facilitate the exchange of one token type for another within the protocol's ecosystem. However, it does not include any mechanisms to verify that the toToken and fromToken parameters provided in the convertData are legitimate or recognized by the system. This omission could lead to interactions with unsupported or malicious token contracts.

Impact

1. Users could inadvertently or maliciously trigger conversions with token contracts that are designed to disrupt operations or siphon funds.

Tools Used

Manual review

Recommendations

1. Introduce a validation step within the convert function to ensure that toToken and fromToken are recognized and authorized by the protocol. This could involve checking against a list of supported tokens or verifying token contract addresses.