Beanstalk: The Finale

Summary

There is no check whether for and to address are the same.

Vulnerability Details

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/tokens/Fertilizer/Internalizer.sol#L71C4-L85C6

function _transfer(
address from,
address to,
uint256 id,
uint256 amount
) internal virtual override {
uint128 _amount = uint128(amount);
@> if (from != address(0)) {
uint128 fromBalance = _balances[id][from].amount;
require(uint256(fromBalance) >= amount, "ERC1155: insufficient balance for transfer");
// Because we know fromBalance >= amount, we know amount < type(uint128).max
_balances[id][from].amount = fromBalance - _amount;
}
_balances[id][to].amount = _balances[id][to].amount.add(_amount);
}

Impact

There is o check whether both address are same or not.It will cost Gas.

Tools Used

Recommendations

require(from!=to);