Beanstalk: The Finale

Summary

This report identifies a critical security vulnerability in the LibTransfer.sol library. The vulnerability stems from allowing an arbitrary address to be used as the sender parameter in ERC20's transferFrom calls. This oversight enables potential unauthorized token transfers, posing a significant risk of financial loss to token owners. The report details the issue, provides an analysis of the code, discusses its impact, and offers recommendations for remediation.

Vulnerability Details

The LibTransfer.sol library includes functions that facilitate token transfers using ERC20's safeTransferFrom and safeTransfer methods. However, in certain scenarios, the library permits an arbitrary address (sender) to initiate token transfers from another address (recipient) without adequate authorization checks.

Line 42

Line 64

Line 67

• Vulnerability Source: The transferToken function in LibTransfer.sol allows sender to be specified externally, potentially by any address.

• Risk: If an unauthorized address specifies sender, it can transfer tokens from someone else's address (recipient) without proper authorization.

Impact

The vulnerability in LibTransfer.sol presents a significant risk:

• Unauthorized Token Transfers: Any address can potentially transfer tokens from another user's address (recipient) without their consent.

• Financial Loss: Owners of the transferred tokens may suffer financial losses.

• Reputation Damage: The integrity and trustworthiness of the contract and its developers could be compromised.

Tools Used

Manual review

Recommendations

To mitigate the identified vulnerability, consider the following remediation steps:

• Use msg.sender for from Parameter: Modify ERC20 transferFrom calls to use msg.sender instead of an arbitrary sender address to ensure proper authorization.

• Access Control Checks: Implement robust access control mechanisms to restrict token transfers to authorized entities only.

• Security Audits: Conduct regular security audits of smart contracts to identify and address potential vulnerabilities proactively.