Vulnerability Details

The ERC20 Permit feature, as detailed in EIP-2612, is vulnerable to frontrunning because transactions can be observed in the mempool, allowing malicious actors to duplicate and preempt the transaction. This can lead to Denial of Service (DOS) by making the subsequent intended contract functionality fail. Source [trust-security](https://www.trust-security.xyz/post/permission-denied)

Impact

Permit functionality DoS

Code Snippet

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/beanstalk/farm/TokenSupportFacet.sol#L40-L40

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/beanstalk/farm/TokenFacet.sol#L164-L164

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/beanstalk/silo/ApprovalFacet.sol#L156

Tools Used

Manual Analysis

Recommendations

Implement a try-catch wherein incase of a permit() call failure and, if it fails due to frontrunning, continuing with the intended logic if the allowance check passes.