Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

LibUnripeConvert.sol :: getBeanAmountOut() incorrectly calculates the amount of BEAN.

ivanfitro

Summary

getBeanAmountOut() incorrectly uses C.UNRIPE_BEAN.totalSupply() instead of C.UNRIPE_LP.totalSupply() to calculate the BEAN amount, resulting in an incorrect calculation.

Vulnerability Details

getBeanAmountOut() calculates the amount of BEAN tokens a user would receive per BEAN:3CRV LP provided.

function getBeanAmountOut(uint256 amountIn)
internal
view
returns (uint256 bean)
{
uint256 lp = LibUnripe.unripeToUnderlying(
C.UNRIPE_LP,
amountIn,
@> IBean(C.UNRIPE_BEAN).totalSupply()
);
bean = LibWellConvert.getBeanAmountOut(LibBarnRaise.getBarnRaiseWell(), lp);
bean = LibUnripe
.underlyingToUnripe(C.UNRIPE_BEAN, bean)
.mul(LibUnripe.percentBeansRecapped())
.div(LibUnripe.percentLPRecapped());
}

As observed, the calculation in getBeanAmountOut() mistakenly utilizes IBean(C.UNRIPE_BEAN).totalSupply() to determine the LP. However, this line calculates the LP not the BEAN token amount. The correct implementation is using IBean(C.UNRIPE_LP).totalSupply() to next calcualte correctly the desired BEAN token quantity.

Impact

The BEAN token amount obtained is incorrect.

Tools Used

Manual review.

Recommendations

Change IBean(C.UNRIPE_BEAN).totalSupply() for IBean(C.UNRIPE_LP).totalSupply() .

function getBeanAmountOut(uint256 amountIn)
internal
view
returns (uint256 bean)
{
uint256 lp = LibUnripe.unripeToUnderlying(
C.UNRIPE_LP,
amountIn,
- IBean(C.UNRIPE_BEAN).totalSupply()
+ IBean(C.UNRIPE_LP).totalSupply()
);
bean = LibWellConvert.getBeanAmountOut(LibBarnRaise.getBarnRaiseWell(), lp);
bean = LibUnripe
.underlyingToUnripe(C.UNRIPE_BEAN, bean)
.mul(LibUnripe.percentBeansRecapped())
.div(LibUnripe.percentLPRecapped());
}
Updates

Lead Judging Commences

giovannidisiena Lead Judge
over 1 year ago
giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Unripe convert incorrect supply

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.