Beanstalk: The Finale

Summary

This report identifies a potential issue in the FieldFacet.sol that could lead to locked ETH within the contract. The issue is related to the sow and sowWithMin functions, which are both marked as payable even though they currently do not process ETH payments.

Vulnerability Details

The sow and sowWithMin functions in the FieldFacet contract allow users to sow Beans in exchange for Pods. However, both functions are marked as payable. This means that users could accidentally or intentionally send ETH along with the function call.

The contract currently lacks functionality to handle this ETH. Since the functions don't expect ETH payments, they don't process them and the sent ETH would be locked in the contract.

Impact

Loss of funds: Any ETH accidentally or intentionally sent through sow or sowWithMin will be locked in the contract and inaccessible.

Tools Used

Manual code review

Recommendations

Remove the payable modifier from the sow and sowWithMin functions. This will prevent users from accidentally sending ETH along with the function call.

If the contract ever needs to accept ETH payments for future functionalities related to sowing or interacting with Pods, implement a secure mechanism to handle them. This mechanism should clearly explain the purpose of ETH payments and ensure proper processing and withdrawal for authorized users.