Beanstalk: The Finale

Summary

There is no check for array length in lastBalanceOfBatch.

Vulnerability Details

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/tokens/Fertilizer/Internalizer.sol#L61C5-L69C6

function lastBalanceOfBatch(
address[] memory accounts,
uint256[] memory ids
) external view returns (Balance[] memory balances) {
balances = new Balance;
for (uint256 i; i < accounts.length; ++i) {
balances[i] = lastBalanceOf(accounts[i], ids[i]);
}
}

There is no check on the array length in lastBalanceOfBatch.

Impact

there should be a equal length on lastBalanceOfBatch.we will not get the the output balances as required.

Tools Used

Recommendations

require(accounts.length()==ids.length());