Beanstalk Part 1

Summary

The issue in the LibWhitelist:updateStalkPerBdvPerSeasonForToken function is a potential underflow when updating the deltaStalkEarnedPerSeason variable. This occurs when the new stalkEarnedPerSeason value is smaller than the current one, leading to a negative value when calculating the difference between the two.

Vulnerability Details

See the following function:

Impact

If the new stalkEarnedPerSeason value is smaller than the current one, the subtraction operation can result in a negative value. Solidity does not throw an error on underflow, but it wraps around to the maximum positive value for the data type, potentially causing unexpected behavior or incorrect calculations. Which will result in inaccurate tracking of stalk earned per season or incorrect decision-making based on this data.

Tools Used

Manual Review

Recommendations

To address this issue, you can add a validation to ensure that the new stalkEarnedPerSeason value is greater than or equal to the current one before updating the deltaStalkEarnedPerSeason variable. This validation prevents underflow by ensuring that the subtraction operation will not result in a negative value.