Summary

The function UnripeFacet::getPercentPenalty will not revert if it is called with token other than UNRIPE_BEAN and UNRIPE_LP.

Vulnerability Details

The UnripeFacet.sol have multiple functions which are called in the corresponding updater.ts files. Such functions are getRecapFundedPercent and getPercentPenalty. The first function is defined in such way that it reverts when it is given a token which is not UNRIPE_BEAN or UNRIPE_LP. The function below it, the getPercentPenalty function, also takes an unripeToken as an argument, but it does not revert when an unknown token is given.

Impact

The function is used in bean/unripe/updater.ts. If the protocol uses other tokens there will be an unknown call result within the promise. Probability of this to happen is low, so the overall severity of this vulnerability is Low.

Tools Used

Manual Review

Recommendations

Add revert("not supported token"); at the end of the function on Line 247.