Protocol fetches publisher from Tractor instead of using msg.sender. However in some places still msg.sender is used, which is wrong.
For example here it uses msg.sender to pass value into event. However it will use incorrect address in case function was invoked by Tractor module.
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/silo/L2ContractMigrationFacet.sol#L186
Incorrect address will be emitted in event.
Manual Review
Use LibTractor._user()
instead of msg.sender
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.