Beanstalk Part 2

Summary

The _claimPlenty function transfers the earned "plenty" (tokens) to the specified account. The plenty is earned during a Season of Plenty (SOP) and stored in the sop.plenty field of the account's storage.

Vulnerability Details

The potential reentrancy issue arises because the function transfers tokens to the account before deleting the sop.plenty field. This creates a window of opportunity for reentrancy attacks.

An attacker could create a malicious contract that implements a fallback function or another function that calls _claimPlenty. If the attacker's contract is passed as the account argument to _claimPlenty, it could re-enter the _claimPlenty function multiple times within the same transaction before the sop.plenty field is deleted, ultimately draining the contract's token balance.

See the following code:

Impact

If an attacker successfully exploits the reentrancy vulnerability, they could repeatedly call the _claimPlenty function within the same transaction, each time receiving the token transfer and resetting the sop.plenty field. This could result in an undesired depletion of tokens from the contract's balance, leading to financial loss or disruption of contract logic.

Tools Used

Manual Review

Recommendations

To mitigate the reentrancy issue, the contract should follow the "Checks-Effects-Interactions" pattern, where state changes are performed before interacting with external contracts. Specifically, the deletion of the sop.plenty field should be done before the transfer.