Summary

Can init after deploy by anyone

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/beanstalk/init/reseed/L2/ReseedField.sol#L39-L57

similar for ReseedSun.sol , ReseedSilo.sol ReseedBarn.sol , ReseedField.sol

Vulnerability Details

Access conditions not set, after deployment there is time for race conditions and try to damage protocol.

Impact

Mixing accounts plots and so on.

Tools Used

slither hardhat

Recommendations

Applyn access conditions to init function