Summary

The ERC20 token symbol gotten from the getTokenName function is not sanitized which can lead to potential json injection and xss attacks.

Vulnerability Details

In MetadataFacet.sol, the ERC1155 depositId's URI is calculated through the uri function. The URI is a base64 encoded JSON object that contains the metadata and base64 encoded svg. In the function, we're interested in the getTokenName function.

The function is queried in MetadataImage.sol, in which the ERC20 token's s is aymbol queried. As can be seen from the function, the token symbol is queried and used as is, without any form of sanitization, or length check.

This means the token symbol can basically be anything (letters, numbers, symbols, links, etc), and it will be processed just like that. This makes the URI function vulnerable to malicious code injection through the token symbol. The symbol is passed directly to any front end displaying the beanstalk ERC1155s.
Important to note that SVGs can be used to execute arbitrary Javascript which can be used to create XSS attacks.

Impact

This means that if an the token symbol contains malicious Javascript, this could be used to inject Javascript into the front end. For instance, this can be used to create a fake Metamask pop up that asks a user to sign a message.

Tools Used

Manual Code Review
Using-JavaScript-in-SVG
svg-xssinjection-attacks)

Recommendations

Recommendation is to add input sanitation check to the getTokenName function so that only letters and numbers are allowed.