Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No validation of ```deltaLPTokenSupply``` in ```LibWellBdv::bdv```

kiteweb3

Summary

The LibWellBdv::bdv function calculates the BDV for a given Well LP token. These value is calculated based on the inputedamount and the deltaLPTokenSupply. There is no check if the deltaLPTokenSupply is zero which is used as division in the calculation.

Vulnerability Details

function bdv(
address well,
uint amount
) internal view returns (uint _bdv) {
uint beanIndex = LibWell.getBeanIndexFromWell(well);
​
// For now, assume Beanstalk should always use the first pump and given that the Well has been whitelisted, it should be assumed
// that the first Pump has been verified when the Well was whitelisted.
Call[] memory pumps = IWell(well).pumps();
uint[] memory reserves = IInstantaneousPump(pumps[0].target).readInstantaneousReserves(well, pumps[0].data);
// If the Bean reserve is beneath the minimum balance, the oracle should be considered as off.
require(reserves[beanIndex] >= C.WELL_MINIMUM_BEAN_BALANCE, "Silo: Well Bean balance below min");
Call memory wellFunction = IWell(well).wellFunction();
uint lpTokenSupplyBefore = IWellFunction(wellFunction.target).calcLpTokenSupply(reserves, wellFunction.data);
reserves[beanIndex] = reserves[beanIndex].sub(BEAN_UNIT); // remove one Bean
uint deltaLPTokenSupply = lpTokenSupplyBefore.sub(
IWellFunction(wellFunction.target).calcLpTokenSupply(reserves, wellFunction.data)
);
@> _bdv = amount.mul(BEAN_UNIT).div(deltaLPTokenSupply);
}

Impact

If the deltaLPTokenSupply is zero, the calculation of the bdv would result in a division by zero error. This is because of the denominator in the calculation. When the total deltaLPTokenSupply is zero, dividing by zero is not defined in Solidity, and the contract would revert with an error.

These functions are used widely across the different contracts at crucial places. So they will effect a lot of functionalities.

Tools Used

Manual review.

Recommendations

Add an appropriate check that ensure that the deltaLPTokenSupply is non-zero before performing the division operation.

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Other
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.