Beanstalk: The Finale

Summary

withdrawDeposits has nonReenter guard on it, but not every funtion which is accessible external, some exploit might be possible by using _moew, endTotalGermination, claimFertilized

or any other function added by diamond proxy,
especially that with safe transfer wich no checks , and possibility
any token ERC20 can be whtielisted by bean Governance in future,

that is huge opening.

Vulnerability Details

We start with withdraw deposit

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/beanstalk/silo/SiloFacet/SiloFacet.sol#L107-L115

LibTransfer.sendToken has no check of result in this contract SiloFacet.sol
which triggers safe transfer with no checks.

Impact

Can try siphon the whole contracts deposits.

Tools Used

Slither , hardhat, code analyze.

Recommendations

apply some data checks to the call of funtion in library

try LibTransfer.sendToken(IERC20(token), amount, recipient, mode)

{ return

true; }

catch {

return false;

}