Beanstalk: The Finale

Summary

The TokenSupportFacet::permitERC20 function is designed to support ERC-20 tokens that implement the IERC20Permit interface. However, the Wrapped Ether (WETH) token does not implement the permit function. This could allow a malicious user to call the function without a valid signature, leading to potential security vulnerabilities.

Vulnerability Details

The TokenSupportFacet::permitERC20 function calls the ERC20::permit function and the goal of the function is to support the contracts that inherit ERC20Permit contract.

The problem is that not all ERC20 tokens have permit function in their token contracts. The WETH token is one of them and this token is used from the protocol. If a token like WETH, which does not implement permit, is passed, the function will not revert, potentially allowing unauthorized approvals:

Link: https://solidity-by-example.org/hacks/weth-permit/

Impact

Malicious users could call the permitERC20 function with an empry signature and WETH token that does not implement permit function, bypassing signature verification and gaining approval to transfer tokens from the victim's account without their consent. This leads to loss of tokens for the victim.

Tools Used

Manual Review

Recommendations

Implement a check to ensure the token contract supports the permit function before calling it.