Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No check smaller newBDV value when calculating deltaBDV in `enrootDeposit`

0xbeastboy

Summary

The calculation deltaBDV = newBDV.sub(ogBDV) assumes that the new BDV is always greater than or equal to the original BDV (ogBDV). However, this assumption may not hold true in all cases. If for some reason the new BDV is less than the original BDV, the subtraction newBDV.sub(ogBDV) will result in a negative value.

Vulnerability Details

See the below code:

function enrootDeposit(address token, int96 stem, uint256 amount) external payable nonReentrant mowSender(token) {
require(s.u[token].underlyingToken != address(0), "Silo: token not unripe");
​
// remove Deposit and Redeposit with new BDV
uint256 ogBDV = LibTokenSilo.removeDepositFromAccount(msg.sender, token, stem, amount);
​
// Remove Deposit does not emit an event, while Add Deposit does.
emit RemoveDeposit(msg.sender, token, stem, amount, ogBDV);
​
// Calculate the current BDV for `amount` of `token` and add a Deposit.
uint256 newBDV = LibTokenSilo.beanDenominatedValue(token, amount);
​
LibTokenSilo.addDepositToAccount(
msg.sender, token, stem, amount, newBDV, LibTokenSilo.Transfer.noEmitTransferSingle
); // emits AddDeposit event
​
// Calculate the difference in BDV. Reverts if `ogBDV > newBDV`.
uint256 deltaBDV = newBDV.sub(ogBDV);
​
LibTokenSilo.incrementTotalDepositedBdv(token, deltaBDV);
​
// enroots should mint active stalk,
// as unripe assets have been in the system for at least 1 season.
uint256 deltaStalk = deltaBDV.mul(s.ss[token].stalkIssuedPerBdv).add(
LibSilo.stalkReward(stem, LibTokenSilo.stemTipForToken(token), uint128(deltaBDV))
);
​
LibSilo.mintActiveStalk(msg.sender, deltaStalk.toUint128());
}

Impact

The calculation of deltaStalk relies on deltaBDV. If deltaBDV is negative, it would result in unexpected behavior or incorrect calculations for the amount of stalk to mint, potentially leading to incorrect rewards for users.

Tools Used

Manual Review

Recommendations

To mitigate this issue, you should add a check to ensure that the new BDV is greater than or equal to the original BDV before calculating deltaBDV. If the new BDV is less than the original BDV, you should handle this case appropriately, such as reverting with an error message or taking corrective actions.

Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.