Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing validation in ```UsdPrice``` returned by ```LibUsdOracle.getUsdPrice(barnRaiseToken)```in ```FertilizerFacet::_getMintFertilizerOut``` can lead to mint Fertilizer failure

kiteweb3

Summary

The missing validation in UsdPrice returned by LibUsdOracle.getUsdPrice(barnRaiseToken) ineErtilizerFacet:: can lead to mint Fertilizer (FertilizerFacet::mintFertilizer) failure.
The FertilizerFacet::_getMintFertilizerOut function called in FertilizerFacet::mintFertilizer the performs a division operation using the result of LibUsdOracle.getUsdPrice(barnRaiseToken). If the getUsdPrice function returns a 0 value for the given barnRaiseToken, the division operation will attempt to divide by 0, which is undefined in Solidity, reverting the transaction.

Vulnerability Details

FertilizerFacet.sol
function _getMintFertilizerOut(
uint256 tokenAmountIn,
address barnRaiseToken
) public view returns (uint256 fertilizerAmountOut) {
@> fertilizerAmountOut = tokenAmountIn.div(
@> LibUsdOracle.getUsdPrice(barnRaiseToken)
);
}
​
LibUsdOracle.sol
function getUsdPrice(address token, uint256 lookback) internal view returns (uint256) {
if (token == C.WETH) {
uint256 ethUsdPrice = LibEthUsdOracle.getEthUsdPrice(lookback);
@> if (ethUsdPrice == 0) return 0;
return uint256(1e24).div(ethUsdPrice);
}
if (token == C.WSTETH) {
uint256 wstethUsdPrice = LibWstethUsdOracle.getWstethUsdPrice(lookback);
@> if (wstethUsdPrice == 0) return 0;
return uint256(1e24).div(wstethUsdPrice);
}
revert("Oracle: Token not supported.");
}

Impact

If the UsdPrice of the barnRaiseToken returned by the LibUsdOracle.getUsdPrice(barnRaiseToken) is zero, the calculation of fertilizerAmountOut in _getMintFertilizerOut would result in a division by zero error. This is because of the denominator in the calculation. When the usdPrice is zero (due a some market condition) the contract would revert with an error because dividing by zero is not defined in Solidity. The mintFertilizer function reverts too failing the minting.

Tools Used

Manual review

Recommendations

Add a check to ensure that the price returned by LibUsdOracle.getUsdPrice(barnRaiseToken) is not 0 before performing the division.

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.