Beanstalk: The Finale

Summary

The UnripeFacet.sol contract handles functionalities related to unripe tokens, including their management and the conversion (chopping) into ripe tokens. The identified issue relates to the use of an arbitrary address as the from parameter in the ERC20 transferFrom calls, which can lead to unauthorized token transfers and potential loss of funds.

Vulnerability Details

By allowing an arbitrary address to be used as the from parameter in the transferFrom function, the contract permits anyone to transfer tokens from another user's address without proper authorization. This can result in unauthorized token transfers and a potential loss of funds for the token owner.

Code snippet:

The function LibTractor._user() returns an arbitrary address, which is used as the from parameter in the safeTransferFrom call.

Impact

High. This vulnerability can be exploited to transfer tokens from any user's address without their consent, leading to significant financial loss.

Tools Used

Manual review

Recommendations

• Use msg.sender for from Parameter:
  Ensure that the from parameter in all safeTransferFrom calls is msg.sender to prevent unauthorized transfers.