Beanstalk Part 2

Summary

LibFertilizer#addFertilizer function don't check IERC.transferFrom return value will cause protocol add more liquidity than actually.

Vulnerability Details

When call LibFertilizer#addFertilizer function transfer barnRaiseToken to contract, it don't check the transferFrom return value if true or false, some tokens transferFrom function may return false rather than revert, in such cases, because protocol don't check the return value and continue call IWell(barnRaiseWell).addLiquidity will cause protocol add more liquidity than actually, make liquidity account error, but the sender transfer nothing actually.

Impact

Protocol will add more liquidity than actually.

Tools Used

vscode, Manual Review

Recommendations

Check the return value of IERC20#transferFrom function.