Beanstalk: The Finale

Summary

The LibTokenApprove.sol contract in the Beanstalk project has a front-running vulnerability in the spendAllowance function. This vulnerability can be exploited to spend beyond the approved token allowance, causing inconsistencies in balances and potentially leading to loss of funds.

Vulnerability Details

The spendAllowance function in LibTokenApprove.sol performs two separate steps:

• Check allowance: Checks if the current allowance is sufficient to spend the desired amount of tokens.

• Update allowance: If sufficient, the function decreases the allowance by the amount of tokens spent.

However, separating these two steps creates a small window of time between checking and updating the allowance. An attacker can exploit this window to perform another transaction before the allowance is updated, resulting in spending beyond the original approved allowance.

Impact

The attacker can spend tokens beyond the approved allowance, causing loss of funds for the token owner.

Tools Used

Manual

Recommendations

use the _spendAllowance function from OpenZeppelin Contracts, combining the allowance check and update into a single atomic step