Beanstalk Part 2

Summary

Lack of access control in init() function enable anyone to call it.

Vulnerability Details

Inside InitMigrateUnripeBeanEthToBeanSteth.sol, in function init() there is no access control modifier or check to ensure that only authorized person or contract can call this function.

Impact

Anyone can call init() function and Initializes the Migration of the Unripe LP underlying tokens from Bean:Eth to Bean:Steth.

Tools Used

Manual

Recommendations

Add this function to ensure only LivDiamond contract or its owner can call it

LibDiamond.enforceIsOwnerOrContract();