Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Token that is not whitelisted can bypass broken validation

holydevoti0n

Summary

When the function dewhitelistToken is called it deletes the following data:

delete s.ss[token].selector;
delete s.ss[token].encodeType;
// delete gaugePoints, gaugePointSelector, liquidityWeightSelector, and optimalPercentDepositedBdv.
delete s.ss[token].gaugePoints;
delete s.ss[token].gpSelector;
delete s.ss[token].lwSelector;
delete s.ss[token].optimalPercentDepositedBdv;

The attribute selector is used to check whether the token is not whitelisted LibTokenSilo:

LibTokenSilo.beanDenonimatedValue:

require(s.ss[token].selector != bytes4(0), "Silo: Token not whitelisted");

This logic makes sense as any token that is not in the whitelist doesn't have a selector either because the token hasn't been added or because it went through the dewhitelist function.

But the function updateStalkPerBdvPerSeasonForToken from LibWhitelist utilizes the milestoneSeason attribute which is never deleted since the moment that a token is added to the whitelist.

It means that a token that was passed on dewhitelistToken will still be considered a whitelisted token and his attributes will be updated such as:

if (stalkEarnedPerSeason == 0) stalkEarnedPerSeason = 1;
​
// update milestone stem and season.
s.ss[token].milestoneStem = LibTokenSilo.stemTipForToken(token);
s.ss[token].milestoneSeason = s.season.current;
// stalkEarnedPerSeason is set to int32 before casting down.
s.ss[token].deltaStalkEarnedPerSeason = int24(int32(stalkEarnedPerSeason) - int32(s.ss[token].stalkEarnedPerSeason)); // calculate delta
s.ss[token].stalkEarnedPerSeason = stalkEarnedPerSeason;

Impact

A token that is not whitelisted can bypass this function and disrupt the protocol's logic.

Tools Used

Manual Review

Recommendations

Check for the selector instead of milestoneSeason to ensure the token is not whitelisted.

- require(s.ss[token].milestoneSeason != 0, "Token not whitelisted");
+ require(s.ss[token].selector != bytes4(0), "Token not whitelisted");
Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Dewhitelist milestone season

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.