Beanstalk Part 1

Beanstalk

DeFiHardhatOracleProxyUpdates

100,000 USDC

View results

Previous Next

Submission Details

Severity: low

Invalid

When Oracle fails sow reverts and compromise the peg mechanism

holydevoti0n

Summary

When user calls gm and the call for the oracle fails, it will return 0 for the deltaB value and this will impact the following state variables:

s.season.abovePeg - will be set to false on stepSun because deltaB == 0

s.f.soil - will be set to zero also on stepSun because deltaB == 0

Vulnerability Details

sowWithMin utilizes the s.f.soil as a slippage mechanism, but previously when oracle failed on gm call, the following happened on stepSun:

setSoil(uint256(-deltaB)); // @audit deltaB is zero

s.season.abovePeg = false;

As this value is zero, the sow function will prevent any call to sow beans as the value to be minted cannot surpass zero:

(uint256 soil, uint256 _morningTemperature, bool abovePeg) = _totalSoilAndTemperature();

require(

soil >= minSoil && beans >= minSoil,

"Field: Soil Slippage"

);

Transaction will revert due to Field: Soil Slippage

Impact

The peg mechanism will suffer DoS until the next successful call of sunrise + oracle returns the correct data.

Users will not be able to sow their beans when in fact they should because the system will think that there is no soil available.

Storage variables will impact the next season peg as their value was incorrectly updated(soil being set to zero, protocol being set to below peg when it could be above the peg, the temperature changed to an incorrect value due to invalid calcId impacted by deltaB == 0).

PoC

Prepare the environment to work with Foundry + Updated Mocks
https://gist.github.com/h0lydev/fcdb00c797adfdf8e4816031e095fd6c
Make sure to have the mainnet forked through Anvil: anvil --fork-url https://rpc.ankr.com/eth
Create the Season.t.sol file under the folder foundry and paste the code below. Then run forge test --match-contract SeasonTest -vv.

// SPDX-License-Identifier: MIT

pragma solidity =0.7.6;

pragma abicoder v2;

import { Sun } from "contracts/beanstalk/sun/SeasonFacet/Sun.sol";

import { MockSeasonFacet } from "contracts/mocks/mockFacets/MockSeasonFacet.sol";

import { MockSiloFacet } from "contracts/mocks/mockFacets/MockSiloFacet.sol";

import { MockFieldFacet } from "contracts/mocks/mockFacets/MockFieldFacet.sol";

import { MockWhitelistFacet } from "contracts/mocks/mockFacets/MockWhitelistFacet.sol";

import {LibWhitelist} from "contracts/libraries/Silo/LibWhitelist.sol";

import { Utils } from "./utils/Utils.sol";

import "./utils/TestHelper.sol";

import "contracts/libraries/LibSafeMath32.sol";

import "contracts/C.sol";

contract SeasonTest is MockSeasonFacet, TestHelper {

using SafeMath for uint256;

using LibSafeMath32 for uint32;

bool oracleFailed;

function setUp() public {

console.log("diamondSetup");

vm.createSelectFork('local');

oracleFailed = false;

setupDiamond();

dewhitelistCurvePool();

mintUnripeLPToUser1();

mintUnripeBeanToUser1();

setOraclePrices(false, 1000e6, 1000e6, 1000e6);

_setReservesForWell(1000000e6, 1000e18);

// user / tokens

mintTokenForUsers();

setTokenApprovalForUsers();

enableFertilizerAndMintActiveFertilizers();

callSunriseForUser1();

}

//////////// Setup functions ////////////

function setTokenApprovalForUsers() internal {

approveTokensForUser(deployer);

approveTokensForUser(user1);

approveTokensForUser(user2);

approveTokensForUser(user3);

approveTokensForUser(user4);

approveTokensForUser(user5);

}

function mintTokenForUsers() internal {

mintWETHtoUser(deployer);

mintWETHtoUser(user1);

mintWETHtoUser(user2);

mintWETHtoUser(user3);

mintWETHtoUser(user4);

mintWETHtoUser(user5);

// mint C.bean() to users

C.bean().mint(deployer, 10e6);

C.bean().mint(user1, 10e6);

C.bean().mint(user2, 10e6);

C.bean().mint(user3, 10e6);

C.bean().mint(user4, 10e6);

C.bean().mint(user5, 10e6);

}

function approveTokensForUser(address user) prank(user) internal {

mockWETH.approve(address(diamond), type(uint256).max);

unripeLP.approve(address(diamond), type(uint256).max);

unripeBean.approve(address(diamond), type(uint256).max);

well.approve(address(diamond), type(uint256).max);

C.bean().approve(address(field), type(uint256).max);

}

function dewhitelistCurvePool() public {

vm.prank(deployer);

whitelist.dewhitelistToken(C.CURVE_BEAN_METAPOOL);

}

function mintWETHtoUser(address user) prank(user) internal {

mockWETH.mint(user, 1000e18);

}

function mintUnripeLPToUser1() internal {

unripeLP.mint(user1, 1000e6);

}

function mintUnripeBeanToUser1() internal {

unripeBean.mint(user1, 1000e6);

}

function enableFertilizerAndMintActiveFertilizers() internal {

// second parameter is the unfertilizedIndex

fertilizer.setFertilizerE(true, 10000e6);

vm.prank(deployer);

fertilizer.addFertilizerOwner(7500, 1e11, 99);

vm.prank(deployer);

fertilizer.addFertilizerOwner(6200, 1e11, 99);

addUnripeTokensToFacet();

}

function addUnripeTokensToFacet() prank(deployer) internal {

unripe.addUnripeToken(C.UNRIPE_BEAN, C.BEAN, bytes32(0));

unripe.addUnripeToken(C.UNRIPE_LP, C.BEAN_ETH_WELL, bytes32(0));

}

function callSunriseForUser1() prank(user1) internal {

_ensurePreConditions();

_advanceInTime(2 hours);

season.sunrise();

}

function setOraclePrices(bool makeOracleFail, int256 chainlinkPrice, uint256 ethUsdtPrice, uint256 ethUsdcPrice) internal {

if (makeOracleFail) {

_addEthUsdPriceChainlink(0);

oracleFailed = true;

} else {

oracleFailed = false;

_addEthUsdPriceChainlink(chainlinkPrice);

_setEthUsdtPrice(ethUsdtPrice);

_setEthUsdcPrice(ethUsdcPrice);

}

////////////////////////////////////////// TESTS //////////////////////////////////////////

function testSeason_whenOracleFails() public {

// Given the oracle fails

setOraclePrices(true, 0, 0, 0);

_advanceInTime(1 hours);

// When sunrise

vm.prank(user4);

season.sunrise();

_ensurePosConditions();

_ensureInvariants_whenOracacleFailedAreBroken();

// DoS after sunrise, no one can sow anymore, but the last season had soil available to be sown