Beanstalk Part 3

Summary

The following functions in barn/UnripeFacet.sol are marked as payable even though they only deal with ERC20 tokens and do not use msg.value in any capacity.

1. chop

2. pick

3. addUnripeToken

4. addMigratedUnderlying

5. switchUnderlyingToken

Impact

Although I haven't been able to exploit it, any Unripe holder would be able to send untracked ETH into Beanstalk using chop or pick which could be a primitive in a longer exploit chain.

Tools Used

Manual Review

Recommendations

Since none of the functions listed are meant to interact with ETH in any capacity, the most sensible action would be to remove the payable keyword. This would at the very least reduce the domain of possible attack vectors.