Vulnerability: Flood mechanism is susceptible to DoS attacks by a frontrunner, breaking re-peg mechanism when BEAN is above 1 USD
Severity: medium

Description:
A call to the BEAN/3CRV Metapool is made withinWeather::sop, swapping Beans for 3CRV, to aid in returning Beanstalk to peg via a mechanism known as "Flood" (formerly Season of Plenty, or sop) when the Beanstalk Farm has been "Oversaturated" ($P > 1$; $Pod Rate < 5%$) for more than one Season and for each additional Season in which it continues to be Oversaturated. This is achieved by minting additional Beans and selling them directly on Curve, distributing the proceeds from the sale as 3CRV to Stalkholders.\\nUnlike `Oracle::stepOracle`, which returns the aggregate time-weighted `deltaB` value across both the BEAN/3CRV Metapool and BEAN/ETH Well, the current shortage/excess of Beans during the handling of Rain in `Weather::stepWeather` are calculated directly from the Curve Metapool via `LibBeanMetaCurve::getDeltaB`.\\n```\\n    function getDeltaB() internal view returns (int256 deltaB) {\\n        uint256[2] memory balances = C.curveMetapool().get_balances();\\n        uint256 d = getDFroms(balances);\\n        deltaB = getDeltaBWithD(balances[0], d);\\n    }\\n```\\n\\nThis introduces the possibility that a long-tail MEV bot could perform a denial-of-service attack on the Flood mechanism by performing a sandwich attack on `SeasonFacet::gm` whenever the conditions are met such that `Weather::sop` is called. The attacker would first front-run the transaction by selling BEAN for 3CRV, bringing the price of BEAN back to peg, which could result in `newBeans <= 0`, thus bypassing the subsequent logic, and then back-running to repurchase their sold BEAN effectively maintaining the price of BEAN above peg.\\nThe cost for performing this attack is 0.08% of the utilized funds. However, not accounting for other mechanisms (such as Convert) designed to return the price of Bean to peg, Beanstalk would need to wait the Season duration of 1 hour before making another effective `SeasonFacet::gm`, provided that the previous transaction did not revert. In the subsequent call, the attacker can replicate this action at the same cost, and it is possible that the price of BEAN may have increased further during this hour.

Impact:
Attempts by Beanstalk to restore peg via the Flood mechanism are susceptible to denial-of-service attacks by a sufficiently well-funded sandwich attacker through frontrunning of `SeasonFacet::gm`.

Recommended mitigation:
Consider the use of an oracle to determine how many new Beans should be minted and sold for 3CRV. This implies the following modification:\\n```\\n    function sop() private {\\n// Remove the line below\\n       int256 newBeans = LibBeanMetaCurve.getDeltaB();\\n// Add the line below\\n       int256 currentDeltaB = LibBeanMetaCurve.getDeltaB();\\n// Add the line below\\n       (int256 deltaBFromOracle,)  = // Remove the line below\\n LibCurveMinting.twaDeltaB();\\n// Add the line below\\n       // newBeans = max(currentDeltaB, deltaBFromOracle)\\n// Add the line below\\n       newBeans = currentDeltaB > deltaBFromOracle ? currentDeltaB : deltaBFromOracle;\\n\\n        if (newBeans <= 0) return;\\n\\n        uint256 sopBeans = uint256(newBeans);\\n        uint256 newHarvestable;\\n\\n        // Pay off remaining Pods if any exist.\\n        if (s.f.harvestable < s.r.pods) {\\n            newHarvestable = s.r.pods // Remove the line below\\n s.f.harvestable;\\n            s.f.harvestable = s.f.harvestable.add(newHarvestable);\\n            C.bean().mint(address(this), newHarvestable.add(sopBeans));\\n        } else {\\n            C.bean().mint(address(this), sopBeans);\\n        }\\n\\n        // Swap Beans for 3CRV.\\n        uint256 amountOut = C.curveMetapool().exchange(0, 1, sopBeans, 0);\\n\\n        rewardSop(amountOut);\\n        emit SeasonOfPlenty(s.season.current, amountOut, newHarvestable);\\n    }\\n```\\n\\nThe motivation for using the maximum value between the current `deltaB` and that calculated from time-weighted average balances is that the action of an attacker increasing `deltaB` to carry out a sandwich attack would be nonsensical as excess Bean minted by the Flood mechanism would be sold for additional 3CRV. In this way, anyone attempting to increase `deltaB` would essentially be giving away their 3CRV LP tokens to Stalkholders. Therefore, by using the maximum `deltaB`, it is ensured that the impact of any attempt to execute the attack described above would be minimal and economically unattractive. If no one attempts the attack, the behavior will remain as originally intended.\\n\\clearpage