Beanstalk Part 1
Beanstalk
DeFiHardhatOracleProxyUpdates
100,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

```ConvertFacet::convert``` missing zero output check can lead to deposits lose

kiteweb3

Summary

The ConvertFacet::convert function allows users to convert deposits from one token to another. Due to the absence of a validation check for the output amount (toAmount) being greater than zero, it is possible to execute a conversion that results in no output tokens being received by the user, while still withdrawing the input tokens from their account.

Vulnerability Details

The vulnerability arises from the lack of a check to ensure that the toAmount (the amount of tokens to be received from the conversion) is greater than zero. The contract performs a duplicate check on the input amount (fromAmount) being greater than zero but fails to verify that the conversion will result in a non-zero amount of output tokens. This oversight allows for the execution of conversions that can lead to users losing their deposits without receiving any output.

function convert(
bytes calldata convertData,
int96[] memory stems,
uint256[] memory amounts
)
external
payable
nonReentrant
returns (int96 toStem, uint256 fromAmount, uint256 toAmount, uint256 fromBdv, uint256 toBdv)
{
address toToken; address fromToken; uint256 grownStalk;
​
(toToken, fromToken, toAmount, fromAmount) = LibConvert.convert(convertData);
require(fromAmount > 0, "Convert: From amount is 0.");
​
@> require(fromAmount > 0, "Convert: From amount is 0.");
​
LibSilo._mow(msg.sender, fromToken);
LibSilo._mow(msg.sender, toToken);
(grownStalk, fromBdv) = _withdrawTokens(
fromToken,
stems,
amounts,
fromAmount
);
​
// calculate the bdv of the new deposit
uint256 newBdv = LibTokenSilo.beanDenominatedValue(toToken, toAmount);
​
toBdv = newBdv > fromBdv ? newBdv : fromBdv;
​
toStem = _depositTokensForConvert(toToken, toAmount, toBdv, grownStalk);
emit Convert(msg.sender, fromToken, toToken, fromAmount, toAmount);
}

Impact

The users could lose their deposited tokens without receiving any tokens in return, effectively resulting in a loss of funds. This could undermine user trust in the platform and lead to financial losses for users.

Tools Used

Manual review

Recommendations

Add a validation check to ensure that toAmount is greater than zero.

- require(fromAmount > 0, "Convert: From amount is 0.");
+ require(toAmount > 0, "Convert: To amount is 0.");
Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Convert validation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.