Submission Details
Severity:
Anyone can mint beanstalk to hi address due to missing access control on `FertilizerFacet::mintFertilizer` control.
Vulnerability Details
mintFertilizer inside calling beanstalkMint to msg.sender. But their is no access control on mintFertilizer function so anyone can call this and mint amount of beanstalk to his address.
protocol/contracts/beanstalk/barn/FertilizerFacet.sol#L64-L85
64: function mintFertilizer(
uint256 tokenAmountIn,
uint256 minFertilizerOut,
uint256 minLPTokensOut
) external payable returns (uint256 fertilizerAmountOut) {
...
83: C.fertilizer().beanstalkMint(msg.sender, uint256(id), (fertilizerAmountOut).toUint128(), s.bpf);
}
Impact
Anyone can call mintFertilizer and mint amount of beanstalk to his address.
Tools Used
Manual Review
Recommendation
Add some access control to this function so only protocol expected addresses can call this function.
Updates
Lead Judging Commences
giovannidisiena over 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
Informational/Invalid
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
1,99118 USDC / LOC
30,000 USDC
1,500 USDC
3,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.