Beefy vault can be removed without withdrawing all deposited tokens. Causing these token to be locked forever unless an owner is added this vault back.

Lines of code Vulnerability details Impact Beefy vault can be removed without withdrawing all deposited tokens. Causing these token to be locked forever unless an owner is added this vault back. Proof of Concept function removeVaultaddress vault external onlyOwner requirevaultsvault != address0,...

Vaults are vulnerable to sandwich attacks due to missing slippage checks

Lines of code Vulnerability details Impact Swaps in the new Beefy Vault can have almost all funds taken via MEV sandwich attacks because there is no slippage control Proof of Concept The last argument to addliquidity is the minimum amount to mint, which is zero here: File:...