Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

``newGaugePoints`` is not capped to ``MAX_GAUGE_POINTS`` in a certain case leading to runaway guagePoints.

0xsandy

Summary

newGaugePoints is not capped to MAX_GAUGE_POINTS in a certain case leading to runaway guagePoints.

Vulnerability Details

In the defaultGaugePointFunction() function, gaugePoints needs to be capped to MAX_GUAGE_POINTS to avoid runaway gaugePoints and there is a check to ensure that in case of percentOfDepositedBdv < optimalPercentDepositedBdv.mul(LOWER_THRESHOLD).div(THRESHOLD_PRECISION):

./GuagePointFacet.sol#defaultGaugePointFunction()
​
else if (percentOfDepositedBdv < optimalPercentDepositedBdv.mul(LOWER_THRESHOLD).div(THRESHOLD_PRECISION)) {
newGaugePoints = currentGaugePoints.add(ONE_POINT);
​
// Cap gaugePoints to MAX_GAUGE_POINTS if it exceeds.
if (newGaugePoints > MAX_GAUGE_POINTS) return MAX_GAUGE_POINTS;
}

But, in the case of percentOfDepositedBdv > optimalPercentDepositedBdv.mul(LOWER_THRESHOLD).div(THRESHOLD_PRECISION):

./GuagePointFacet.sol#defaultGaugePointFunction()
​
if (percentOfDepositedBdv > optimalPercentDepositedBdv.mul(UPPER_THRESHOLD).div(THRESHOLD_PRECISION)) {
// gauge points cannot go below 0.
if (currentGaugePoints <= ONE_POINT) return 0;
newGaugePoints = currentGaugePoints.sub(ONE_POINT);
}

There is no check for: if (newGaugePoints > MAX_GAUGE_POINTS) return MAX_GAUGE_POINTS;

Impact

newGuagePoints can break the MAX_GAUGE_POINTS threshold leading to more guagePoints being returned than intended. This breaks the MAX_GAUGE_POINTS invariant and users can receive more guagePoints and consequently more incentives than intended.

Tools Used

Manual Analysis

Recommendations

Add check for if (newGaugePoints > MAX_GAUGE_POINTS) return MAX_GAUGE_POINTS; as follows:

./GuagePointFacet.sol#defaultGaugePointFunction()
​
if (percentOfDepositedBdv > optimalPercentDepositedBdv.mul(UPPER_THRESHOLD).div(THRESHOLD_PRECISION)) {
// gauge points cannot go below 0.
if (currentGaugePoints <= ONE_POINT) return 0;
newGaugePoints = currentGaugePoints.sub(ONE_POINT);
if (newGaugePoints > MAX_GAUGE_POINTS) return MAX_GAUGE_POINTS;
}
Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.