Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

BeanstalkFarms/Beanstalk

              master @ 8e22cd2
            

Fixes

CVEs

CRITICAL

Peak severity

34.5%

Coverage

Highlights

Access Control: 8 prior fixes. Scrutinize any change in this area.

protocol/contracts/farm/facets/SiloFacet/SiloFacet.sol: most-fixed (5 issues). Treat as high-risk during review.

26 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Multiple fixes required adding explicit sender parameters, allowance checks, and zero-address validation to prevent unauthorized token and deposit transfers. Missing checks allowed any caller to move funds or deposits without approval.

Auth Bypass: Ownership transfer and session management lacked proper validation, allowing unauthorized takeover or access. Replacing msg.sender with LibTractor._getUser() closed a critical authorization bypass in CurveFacet.

Incorrect Accounting / Logic Error: Errors in deltaRoots calculation, missing BDV initialization, and rounding in enroot could be economically exploited to inflate or deflate user balances.