Beanstalk: The Finale

Vulnerability Details

Since init function doesn't have any access control but it is one time usable. It will be called through proxy contract. But it still can be frontrun due to absence of access control on it. Since it is updating critical storage values so at the time of migration attacker can call through proxy contract using delegatecall also and set his own values by frontrunning the transaction.

ReseedL2Migration.sol#L27-L31

Impact

At the time of migration attacker can set his own storage values by frontrunning the transaction.

Tools Used

Manual Review

Recommendation

Use some type of access control on init function like setting the owner address in immutable var. at the time of deployment of implementation contract. So that only owner can call this function through proxy using delegatecall.