Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Access Control in init Function

wttt

Summary

Since the init function is declared as an external function, anyone can call it without authorization or permission. This means that anyone can trigger the initialization of the token migration process.

Vulnerability Details

function init() external {
​
// Turn off Bean:Eth Minting while Multi Flow Pump catches up
delete s.wellOracleSnapshots[C.BEAN_ETH_WELL];
s.season.beanEthStartMintingSeason = s.season.current + BEAN_ETH_PUMP_CATCH_UP_SEASONS;
​
LibWhitelist.whitelistToken(
C.BEAN_WSTETH_WELL,
BDVFacet.wellBdv.selector,
STALK_ISSUED_PER_BDV,
0, // No need to set Stalk issued per BDV
0x01,
IGaugePointFacet.defaultGaugePointFunction.selector,
ILiquidityWeightFacet.maxWeight.selector,
BEAN_WSTETH_INITIAL_GAUGE_POINTS,
OPTIMAL_PERCENT_DEPOSITED_BDV
);
​
LibWhitelist.updateOptimalPercentDepositedBdvForToken(
C.BEAN_ETH_WELL,
MAX_PERCENT_DEPOSITED_BDV - OPTIMAL_PERCENT_DEPOSITED_BDV
);
​
LibFertilizer.beginBarnRaiseMigration(C.BEAN_WSTETH_WELL);
​
}

  1. Delete the global state variable s.wellOracleSnapshots[C.BEAN_ETH_WELL]

Without proper permission checks, anyone can call the init() function and delete this state variable. This may leave the contract in an inconsistent state or render related functionality unavailable.

  1. Modify the global state variable s.season.beanEthStartMintingSeason

Likewise, modifications to state variables may lead to unforeseen results, especially if the caller does not have appropriate permissions or parameter validation.

  1. Call other contract functions

Calls to the LibWhitelist.whitelistToken and LibFertilizer.beginBarnRaiseMigration functions are also risky. Unauthorized callers can perform these operations by calling the init() function, which may result in loss of funds or inconsistent contract state.

Impact

Global variables and other functions can be called from any address, causing damage to the protocol

Tools Used

manual review

Recommendations

  1. Add appropriate permission controls in the init() function to ensure that only authorized users can call the function

  2. Limit the number of calls to the init() function

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Init access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.