Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of appropriate checks in the `addUnripeToken` function, this can lead to an accidental update of the `underlyingToken`

joshuajee

Vulnerability Details

The addUnripeToken function is used to add unripe token. But it can also be use to update the token details including the underlyingToken. The problem is that the original function switchUnderlyingToken that switch underlyingToken ensures that the balance of the underlyingToken is zero before updating it.

function switchUnderlyingToken(
address unripeToken,
address newUnderlyingToken
) external payable {
LibDiamond.enforceIsContractOwner();
@-> require(s.u[unripeToken].balanceOfUnderlying == 0, "Unripe: Underlying balance > 0");
LibUnripe.switchUnderlyingToken(unripeToken, newUnderlyingToken);
}

The addUnripeToken function bypasses this, because this function has the ability to add and update the unripeToken details including underlyingToken, without any checks.

function addUnripeToken(
address unripeToken,
address underlyingToken,
bytes32 root
) external payable nonReentrant {
LibDiamond.enforceIsOwnerOrContract();
@-> s.u[unripeToken].underlyingToken = underlyingToken;
s.u[unripeToken].merkleRoot = root;
emit AddUnripeToken(unripeToken, underlyingToken, root);
}

Impact

Potential Loss of Funds

Tools Used

Manual Analysis

Recommendations

Add checks to ensures that the underlyingToken for an unripeToken is empty before updating it.

function addUnripeToken(
address unripeToken,
address underlyingToken,
bytes32 root
) external payable nonReentrant {
LibDiamond.enforceIsOwnerOrContract();
+ require(s.u[unripeToken].underlyingToken != address(0), "Unripe Token already exist");
s.u[unripeToken].underlyingToken = underlyingToken;
s.u[unripeToken].merkleRoot = root;
emit AddUnripeToken(unripeToken, underlyingToken, root);
}
Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Lack of quality
Assigned finding tags:

Informational/Invalid

joshuajee Submitter
over 1 year ago
giovannidisiena Lead Judge
over 1 year ago
joshuajee Submitter
over 1 year ago
giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Lack of quality
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.