Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The stalkIssuedPerBdv variable is not updated in the dewhitelistToken function

wttt

Summary

The stalkIssuedPerBdv variable is not updated in the dewhitelistToken function

Vulnerability Details

The dewhitelistToken function removes an ERC-20 token from the Silo whitelist, but s.ss[token].stalkIssuedPerBdv will not be updated.

function dewhitelistToken(address token) internal {
AppStorage storage s = LibAppStorage.diamondStorage();
​
// before dewhitelisting, verify that `libWhitelistedTokens` are updated.
LibWhitelistedTokens.updateWhitelistStatus(token, false, false, false);
// set the stalkEarnedPerSeason to 1 and update milestone stem.
// stalkEarnedPerSeason requires a min value of 1.
updateStalkPerBdvPerSeasonForToken(token, 1);
​
// delete the selector and encodeType.
delete s.ss[token].selector;
delete s.ss[token].encodeType;
// delete gaugePoints, gaugePointSelector, liquidityWeightSelector, and optimalPercentDepositedBdv.
delete s.ss[token].gaugePoints;
delete s.ss[token].gpSelector;
delete s.ss[token].lwSelector;
delete s.ss[token].optimalPercentDepositedBdv;
emit DewhitelistToken(token);
}

In the dewhitelistToken, updateWhitelistStatus, and updateStalkPerBdvPerSeasonForToken functions, the update value of s.ss[token] is not completely updated.

Check the relevant SiloSettings as follows:

https://github.com/Cyfrin/2024-04-beanstalk-2/blob/main/protocol/contracts/beanstalk/AppStorage.sol#L603

https://github.com/Cyfrin/2024-04-beanstalk-2/blob/main/protocol/contracts/beanstalk/AppStorage.sol#L435-L449

* @dev A Token is considered Whitelisted if there exists a non-zero {SiloSettings} selector.
*/
struct SiloSettings {
bytes4 selector; // ────────────────────┐ 4
uint32 stalkEarnedPerSeason; // │ 4 (8)
uint32 stalkIssuedPerBdv; // │ 4 (12)
uint32 milestoneSeason; // │ 4 (16)
int96 milestoneStem; // │ 12 (28)
bytes1 encodeType; // │ 1 (29)
int24 deltaStalkEarnedPerSeason; // ────┘ 3 (32)
bytes4 gpSelector; // ────────────────┐ 4
bytes4 lwSelector; // │ 4 (8)
uint128 gaugePoints; // │ 16 (24)
uint64 optimalPercentDepositedBdv; // ──┘ 8 (32)
}

Comparison of the updated status of the current contract:

✅ bytes4 selector; // ────────────────────┐ 4
✅ uint32 stalkEarnedPerSeason; // │ 4 (8)
❌ uint32 stalkIssuedPerBdv; // │ 4 (12)
✅ uint32 milestoneSeason; // │ 4 (16)
✅ int96 milestoneStem; // │ 12 (28)
✅ bytes1 encodeType; // │ 1 (29)
✅ int24 deltaStalkEarnedPerSeason; // ────┘ 3 (32)
✅ bytes4 gpSelector; // ────────────────┐ 4
✅ bytes4 lwSelector; // │ 4 (8)
✅ uint128 gaugePoints; // │ 16 (24)
✅ uint64 optimalPercentDepositedBdv; // ──┘ 8 (32)

Impact

Removing a token's whitelisted status without updating the relevant variables may lead to inconsistencies in the data stored in the contract

Tools Used

Manual review

Recommendations

Please make sure to update or clear related variables appropriately when removing a token's whitelist status

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

De-whitelist Stalk issued per BDV

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.