Beanstalk: The Finale

Summary

Previously there was single Field, so variable s.sys.field in storage contained data about Pods. Now field data is stored in mapping(uint256 => Field) fields.

Problem is that variable s.sys.field is forgotten to delete. And this variable by mistake configured in ReseedField instead of actual mapping s.sys.fields.

Vulnerability Details

Here you can see that s.sys.field is configured:
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/init/reseed/L2/ReseedField.sol#L64-L66

However protocol never uses s.sys.field. It uses s.sys.fields[fieldId] instead.

Impact

Field module is completely broken because Field's main variables are not initialized after migration. At least users can't harvest their Pods because their plotIndex is much bigger than current harvestable index (because s.sys.fields[fieldId].harvestable counts again from 0):
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/field/FieldFacet.sol#L169-L186

Additionally Invariable.sol uses uninitialized value to calculate minimum required balance:
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/Invariable.sol#L189

Tools Used

Manual Review

Recommendations

Configure s.sys.fields in ReseedField.sol and remove s.sys.field from storage.