Beanstalk Part 3

Summary

Where any user can prevent the contract owner from switching the underlying token by sending a small amount of the token to increase its balance. This exploit hinges on the fact that the switchUnderlyingToken function has a require statement that the balance of the underlying token must be zero. As long as this balance is non-zero, the function will revert, effectively locking the ability to switch.

Vulnerability Details

This function checks if the balance of the underlying token is zero before allowing the switch. If any user can increment this balance, they can block this operation.

Users can increment the balanceOfUnderlying through the following function, which can be called through other functions.

• Minting or Adding Tokens: Functions like mintFertilizer or conversion functions (e.g., convertLPToBeans, convertBeansToLP) eventually call incrementUnderlying.

• Incrementing Balance: By calling these functions, anyone can increase the balance of the underlying tokens.

• Switching Prevention: Once the balance is incremented, the switchUnderlyingToken function will revert due to the non-zero balance requirement.

Impact

Allows any user to prevent the contract owner from switching the underlying token by sending a small amount of the token to increase its balance. This effectively locks the contract's ability to switch tokens, potentially causing financial or operational disruption.

Tools Used

Manual Review

Recommendations

Instead of checking if the balance is zero, implement a different logic to allow the switching of tokens.