Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Block timestamp

CryptoThemeX

Summary

Dangerous usage of block.timestamp. block.timestamp can be manipulated by miners.

Vulnerability Details

File: contracts/libraries/Oracle/LibChainlinkOracle.sol
​
/// @audit ******************* Issue Detail *******************
LibChainlinkOracle.checkForInvalidTimestampOrAnswer(uint256,int256,uint256) (contracts/libraries/Oracle/LibChainlinkOracle.sol#138-149) uses timestamp for comparisons.
Dangerous comparisons:
- timestamp == 0 || timestamp > currentTimestamp (contracts/libraries/Oracle/LibChainlinkOracle.sol#144)
- currentTimestamp.sub(timestamp) > CHAINLINK_TIMEOUT (contracts/libraries/Oracle/LibChainlinkOracle.sol#146)
​
/// @audit ************** Possible Issue Line(s) **************
L#144, L#146,
​
/// @audit ****************** Affected Code *******************
138: function checkForInvalidTimestampOrAnswer(
139: uint256 timestamp,
140: int256 answer,
141: uint256 currentTimestamp
142: ) private pure returns (bool) {
143: // Check for an invalid timeStamp that is 0, or in the future
144: if (timestamp == 0 || timestamp > currentTimestamp) return true;
145: // Check if Chainlink's price feed has timed out
146: if (currentTimestamp.sub(timestamp) > CHAINLINK_TIMEOUT) return true;
147: // Check for non-positive price
148: if (answer <= 0) return true;
149: }

GitHub : 138-149

File: contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol
​
/// @audit ******************* Issue Detail *******************
SeasonFacet.seasonTime() (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#63-67) uses timestamp for comparisons.
Dangerous comparisons:
- block.timestamp < s.season.start (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#64)
​
/// @audit ************** Possible Issue Line(s) **************
L#64,
​
/// @audit ****************** Affected Code *******************
63: function seasonTime() public view virtual returns (uint32) {
64: if (block.timestamp < s.season.start) return 0;
65: if (s.season.period == 0) return type(uint32).max;
66: return uint32((block.timestamp - s.season.start) / s.season.period); // Note: SafeMath is redundant here.
67: }

GitHub : 63-67

File: contracts/libraries/Oracle/LibChainlinkOracle.sol
​
/// @audit ******************* Issue Detail *******************
LibChainlinkOracle.getEthUsdTwap(uint256) (contracts/libraries/Oracle/LibChainlinkOracle.sol#70-136) uses timestamp for comparisons.
Dangerous comparisons:
- timestamp <= endTimestamp (contracts/libraries/Oracle/LibChainlinkOracle.sol#97)
- timestamp > endTimestamp (contracts/libraries/Oracle/LibChainlinkOracle.sol#104)
​
/// @audit ************** Possible Issue Line(s) **************
L#97, L#104,
​
/// @audit ****************** Affected Code *******************
97: if (timestamp <= endTimestamp) {
104: while (timestamp > endTimestamp) {

GitHub : 70-136

File: contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol
​
/// @audit ******************* Issue Detail *******************
SeasonFacet.gm(address,LibTransfer.To) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#44-57) uses timestamp for comparisons.
Dangerous comparisons:
- require(bool,string)(seasonTime() > s.season.current,Season: Still current Season.) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#48)
​
/// @audit ************** Possible Issue Line(s) **************
L#48,
​
/// @audit ****************** Affected Code *******************
44: function gm(address account, LibTransfer.To mode) public payable returns (uint256) {
45: uint256 initialGasLeft = gasleft();
46:
47: require(!s.paused, "Season: Paused.");
48: require(seasonTime() > s.season.current, "Season: Still current Season.");
49: uint32 season = stepSeason();
50: int256 deltaB = stepOracle();
51: uint256 caseId = calcCaseIdandUpdate(deltaB);
52: LibGerminate.endTotalGermination(season, LibWhitelistedTokens.getWhitelistedTokens());
53: LibGauge.stepGauge();
54: stepSun(deltaB, caseId);
55:
56: return incentivize(account, initialGasLeft, mode);
57: }

GitHub : 44-57

Impact

block.timestamp can be manipulated by miners so its use in comparison statements or computations will provide extra advantage to miners and attackers.

Tools Used

Manual Review

Recommendations

Avoid relying on block.timestamp.

Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.