Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Invalid deadline for swap operation

kodyvim

Summary

deadline set to almost infinity does not provide protection

Vulnerability Details

swaps could be executed during unfavorable conditions since functions uses type(uint256).max as deadline.
https://github.com/Cyfrin/2024-02-Beanstalk-1/blob/main/protocol/contracts/beanstalk/sun/SeasonFacet/Weather.sol#L209

uint256 amountOut = IWell(sopWell).swapFrom(
C.bean(),
sopToken,
sopBeans,
0,
address(this),
@> type(uint256).max
);

swap provides no deadline since it's set to almost infinity, deadline is used by AMM to prevent users from performing harmful swaps operation, especially during times of volatile market.

Impact

Users swap can be executed during unfavorable times

Tools Used

Manual Review

Recommendations

Allow the caller to set a favorable deadline.

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

SOP swap slippage

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.