Report #24107

Report ID

#24107

Report type

Smart Contract

Has PoC?

Yes

Target

https://etherscan.io/address/0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5

Impacts

Theft of unclaimed yield

Bug Description

The function sends fertilized tokens without validating users. This makes it vulnerable to attacks. Attackers can exploit the function's weak access control to steal fertilized tokens because there are no access control checks in place.

function claimFertilized(uint256[] calldata ids, LibTransfer.To mode)
    external
    payable
{
    uint256 amount = C.fertilizer().beanstalkUpdate(msg.sender, ids, s.bpf);
    LibTransfer.sendToken(C.bean(), amount, msg.sender, mode);
}

Impact

The impact on the project is theft of unclaimed yield. By sending fertilized tokens without validating users, attackers can call the function to steal fertilized tokens.

Risk Breakdown

The lack of access control checks makes the function vulnerable to attacks. Attackers can call the function to steal fertilized tokens because there are no checks to validate users before transferring fertilized tokens.

Difficulty to Exploit: Easy Weakness: CVSS2 Score: 4

Recommendation

Use access control checks to validate users before transferring fertilized tokens.

function claimFertilized(uint256[] calldata ids, LibTransfer.To mode, address user) external payable {
    require(msg.sender == user, "Unauthorized");
    uint256 amount = C.fertilizer().beanstalkUpdate(user, ids, s.bpf);
    LibTransfer.sendToken(C.bean(), amount, user, mode);
}

References

https://etherscan.io/address/0xFC7Ed192a24FaB3093c8747c3DDBe6Cacd335B6C#code#F1#L32

https://docs.bean.money/developers/protocol/barn/fertilizer-facet

Proof of concept

A proof of concept to demonstrate the vulnerability in Function claimFertilized.

Setup: Foundry, FertilizerFacet address, the Attacker's contract and test contract.

Run this in the console to get the necessary contracts needed to run the poc.

cast etherscan-source 0xFC7Ed192a24FaB3093c8747c3DDBe6Cacd335B6C -d src/external

Attacker's Contract

pragma solidity 0.7.6;

import "forge-std/console.sol";

import "../FertilizerFacet/contracts/libraries/Token/LibTransfer.sol";

contract Attack { address target; uint256[] public ids;

}

FertilizerFacet Address

Test Contract

// SPDX-License-Identifier: MIT pragma solidity ^0.7.6;

import "forge-std/Test.sol";

import "../../src/reentrancy/examples/AT.sol";

contract AttackTest is Test {

Attack public attackContract;
address Fertilizer = address(0xFC7Ed192a24FaB3093c8747c3DDBe6Cacd335B6C);

function setUp() public {
    // Deploy the attack contract
    attackContract = new Attack(address(Fertilizer));
}

function testAttackClaim() public {

    // Call the attack function
    attackContract.attackCLaim();
}

}

Run this in the console to test the poc: forge test -vv --match-path test/A.t.sol

Replace A.t.sol with the name of your test contract

Result

Running 1 test for test/A.t.sol:AttackTest [PASS] testAttackClaim() (gas: 82223) Logs: Attacker's balance after attack: 79228162514264337593543950335

Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 151.71ms Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)