Beanstalk Part 1

Summary

Hey team,
A gas consumption vulnerability has been identified in the getEthUsdTwap function of the LibChainlinkOracle library in the Beanstalk protocol. This vulnerability could potentially lead to excessive gas consumption, causing transactions to fail or become prohibitively expensive for users.

Vulnerability Details

1. Deploy the contract containing the LibChainlinkOracle library.

2. Call the getEthUsdTwap function with a large lookback parameter, such as 100,000 seconds.

3. Observe the gas consumption during the function call.

Full POC Script:**

Output:

If the gas estimate for calling the testGasConsumption function exceeds the predefined gas limit threshold, the test will fail with an assertion error.

Impact

The excessive gas consumption caused by this vulnerability could lead to failed transactions or significantly increased transaction costs for users interacting with contracts that utilize the LibChainlinkOracle library.

Tools Used

Manual code audit

Recommendations

To mitigate this gas consumption vulnerability, consider refactoring the getEthUsdTwap function to reduce the number of external calls inside loops or optimize the gas usage within the function. Additionally, it's important to carefully evaluate the gas consumption of all functions within the LibChainlinkOracle library to ensure efficient gas usage.