Beanstalk: The Finale

Summary

The constructor in the BeanstalkERC20.sol contract lacks parameter validation. Specifically, the constructor does not validate the admin address, name, and symbol parameters, which can lead to unexpected and potentially detrimental behavior within the contract's operations.

Vulnerability Details

In Solidity, constructors are used to initialize state variables of a contract. However, without proper validation checks, the provided values may not adhere to the intended logic of the protocol. This can compromise the contract's security and impact its maintainability and reliability.

In the BeanstalkERC20.sol contract, the constructor lacks validation for the following parameters:

• admin address: Ensuring it is not the zero address.

• name: Ensuring it is not an empty string.

• symbol: Ensuring it is not an empty string.

Impact

By not validating the constructor parameters, the contract is exposed to potential issues such as:

• Assigning an invalid or zero address to the admin, which could lead to loss of control over the contract.

• Setting empty or incorrect values for name and symbol, which could cause confusion and affect the usability of the token.

• These issues can compromise the integrity and expected behavior of the protocol, leading to potential security vulnerabilities and operational failures.

Tools Used

Manual code review

Recommendations

To mitigate the risks associated with unvalidated constructor parameters, the following validation checks should be incorporated into the constructor: