Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`burnGerminatingStalk` Doesn't handle if stalk exceeds farmer/unclaimed germinating stalk

0xbeastboy

Summary

In the LibSilo:burnGerminatingStalkfunction, there is no check to ensure that the stalk parameter is not greater than the s.a[account].farmerGerminating stalk or s.unclaimedGerminating[season] stalk. This will result in negative values after subtraction, which is not acceptable.

Vulnerability Details

See vulnerability here:

function burnGerminatingStalk(address account, uint128 stalk, LibGerminate.Germinate germ) internal {
AppStorage storage s = LibAppStorage.diamondStorage();
if (germ == LibGerminate.Germinate.ODD) {
s.a[account].farmerGerminating.odd = s.a[account].farmerGerminating.odd.sub(stalk);
} else {
s.a[account].farmerGerminating.even = s.a[account].farmerGerminating.even.sub(stalk);
}
​
// germinating stalk are either newly germinating, or partially germinated.
// Thus they can only be decremented in the latest or previous season.
uint32 season = s.season.current;
if (LibGerminate.getSeasonGerminationState() == germ) {
s.unclaimedGerminating[season].stalk = s.unclaimedGerminating[season].stalk.sub(stalk);
} else {
s.unclaimedGerminating[season.sub(1)].stalk = s.unclaimedGerminating[season.sub(1)].stalk.sub(stalk);
}
​
// emit events.
emit LibGerminate.FarmerGerminatingStalkBalanceChanged(account, -int256(stalk));
}

Impact

These mentioned variables are unsigned integers. Storing negative values in unsigned integer variables will lead to unexpected behavior and could potentially disrupt the entire unclaimed process. This issue could introduce inconsistencies in the system and may cause unintended consequences.

Tools Used

Manual Review

Recommendations

Add a check to ensure that stalk does not exceed mentioned variables before subtracting the values. If it does, you can handle this situation appropriately, such as reverting the transaction or logging an error message.

Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.