Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`InitMigrateUnripeBeanEthToBeanSteth. init`will revert due to the `C.BEAN_WSTETH_WELL` pointing to an empty address, causing the migration to fail.

BARW

Summary

InitMigrateUnripeBeanEthToBeanSteth. init will revert due to the C.BEAN_WSTETH_WELL pointing to an empty address, causing the migration to fail.

Vulnerability Details

C.BEAN_WSTETH_WELL pointing to an empty address on the mainnet will cause a revert at LibFertilizer.beginBarnRaiseMigration when executing the InitMigrateUnripeBeanEthToBeanSteth.init on the mainnet.

Here is where LibFertilizer.beginBarnRaiseMigration will revert.

@audit this line will revert if well is a empty address
IERC20[] memory tokens = IWell(well).tokens();

https://etherscan.io/address/0xa61Ef2313C1eC9c8cf2E1cAC986539d136b1393E

It is also not the correct address as pre-calculated by the Uniswap V2 Factory.

POC

Add this file to the test folder and run it with this command forge test -vv --mt test_get_address

// SPDX-License-Identifier: MIT
pragma solidity 0.8.0;
import {SafeMath} from "openzeppelin/utils/math/SafeMath.sol";
import "forge-std/Test.sol";
import "forge-std/console.sol";
​
contract TestPrecisionLoss is Test {
using SafeMath for uint256;
​
function setUp() public {}
​
function pairFor(
address factory,
address tokenA,
address tokenB
) internal pure returns (address pair) {
(address token0, address token1) = sortTokens(tokenA, tokenB);
pair = address(
uint160(
uint(
keccak256(
abi.encodePacked(
hex"ff",
factory,
keccak256(abi.encodePacked(token0, token1)),
hex"96e8ac4277198ff8b6f785478aa9a39f403cb768dd02cbee326c3e7da348845f" // init code hash
)
)
)
)
);
}
​
function sortTokens(
address tokenA,
address tokenB
) internal pure returns (address token0, address token1) {
require(tokenA != tokenB, "UniswapV2Library: IDENTICAL_ADDRESSES");
(token0, token1) = tokenA < tokenB
? (tokenA, tokenB)
: (tokenB, tokenA);
require(token0 != address(0), "UniswapV2Library: ZERO_ADDRESS");
}
​
function test_get_address() external {
address WSTETH = 0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0;
address BEAN = 0xBEA0000029AD1c77D3d5D23Ba2D8893dB9d1Efab;
address UNISWAPV2_FACTORY = 0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f;
address POOL_ADDRESS = pairFor(UNISWAPV2_FACTORY, BEAN, WSTETH);
console.log("pool address:", POOL_ADDRESS);
}
}
​

Here is the execution result:

pool address: 0xE597eFBd383965FE1d2904c03AbAE967d4387eC0

Impact

LibFertilizer.beginBarnRaiseMigration will revert, causing the migration to fail.

Tools Used

Vscode

Recommendations

Update the C.BEAN_WSTETH_WELL to the right address.(0xE597eFBd383965FE1d2904c03AbAE967d4387eC0)

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Other
Assigned finding tags:

BEAN:wstETH Well address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.