Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Front-Running Vulnerability in chop Function

lordofterra

Summary

The chop function is designed to convert an unripe token to its underlying ripe token. The conversion rate is dynamic, depending on the total supply of the unripe token at the time of the transaction.

function chop(
address unripeToken,
uint256 amount,
LibTransfer.From fromMode,
LibTransfer.To toMode
) external payable nonReentrant returns (uint256) {
// burn the token from the msg.sender address
uint256 supply = IBean(unripeToken).totalSupply();
amount = LibTransfer.burnToken(IBean(unripeToken), amount, msg.sender, fromMode);
// get ripe address and ripe amount
(address underlyingToken, uint256 underlyingAmount) = LibChop.chop(
unripeToken,
amount,
supply
);
// send the corresponding amount of ripe token to the user address
require(underlyingAmount > 0, "Chop: no underlying");
IERC20(underlyingToken).sendToken(underlyingAmount, msg.sender, toMode);
// emit the event
emit Chop(msg.sender, unripeToken, amount, underlyingAmount);
return underlyingAmount;
}

Vulnerability Details

The function is susceptible to front-running because the transaction can be seen in the mempool before being mined. An attacker could execute a transaction that modifies the total supply of the unripe token, thus affecting the conversion rate for the pending chop transaction.

Impact

Users will receive a different amount of underlying tokens than expected if an attacker successfully front-runs the transaction.

Tools Used

manual review

Recommendations

  1. Implement a time-weighted average price (TWAP) oracle to determine conversion rates.

  2. Use commit-reveal schemes to obscure transaction details.

  3. Consider using gas price limits to prevent front-running by prioritizing transactions with lower gas prices.

Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.