Beanstalk Part 2

Summary

The addFertilizer function in the LibFertilizer library is responsible for processing the addition of fertilizer to the system. It begins by validating input parameters such as the season, token amount, fertilizer amount, and minimum LP. After converting the fertilizerAmount parameter to a uint128, the function calculates the Beans Per Fertilizer (BPF) based on the current season and humidity levels.

Subsequently, it updates various state variables in the contract to reflect the addition of fertilizer, including the total unfertilized index and active fertilizer amount. Additionally, it calculates and adds the corresponding underlying beans and LP tokens. If it's the first time adding fertilizer with a specific ID, the function logs the end BPF and adds it to the season queue. Finally, an event is emitted to notify external listeners about the fertilizer addition.

Vulnerability Details

Here, fertilizerAmount is a uint256, but it is being downcasted to a uint128. If fertilizerAmount exceeds the maximum value that can be represented by a uint128, downcasting will truncate the value, potentially causing an overflow or loss of precision.

For example, if fertilizerAmount is greater than 2^128 - 1, the downcast operation will result in an inaccurate representation of fertilizerAmount128, leading to unexpected behavior or vulnerabilities.

See the following code:

Impact

The impact of this issue can be severe. In the worst-case scenario, an attacker could exploit the downcasting vulnerability to manipulate the fertilizerAmount, causing unintended changes in the contract state, loss of funds, or disruption of the application logic.

Tools Used

Manual Review

Recommendations

To mitigate this issue, it's essential to handle the downcasting operation safely by performing appropriate range checks and ensuring that the converted value fits within the target data type.