Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`BEANS_TO_CURVE_LP` conversion omitted in `LibConvert.convert()`

tigerfrake

Summary

LibConvert.convert() function:

/**
* @notice Takes in bytes object that has convert input data encoded into it for a particular convert for
* a specified pool and returns the in and out convert amounts and token addresses and bdv
* @param convertData Contains convert input parameters for a specified convert
*/

This function performs the conversions as stated in the ConvertKind enum from LibConvertData. However, one of these conversions, BEANS_TO_CURVE_LP, is omitted in the convert() function.

Vulnerability Details

The ConvertKind enum from LibConvertData is initialized as kind in the LibConvert contract:

  • https://github.com/Cyfrin/2024-04-beanstalk-2/blob/27ff8c87c9164c1fbff054be5f22e56f86cdf127/protocol/contracts/libraries/Convert/LibConvert.sol#L40

LibConvertData.ConvertKind kind = convertData.convertKind();

The enum specifies 8 conversions as follows:

  • https://github.com/Cyfrin/2024-04-beanstalk-2/blob/27ff8c87c9164c1fbff054be5f22e56f86cdf127/protocol/contracts/libraries/Convert/LibConvertData.sol#L12-L21

enum ConvertKind {
BEANS_TO_CURVE_LP,
CURVE_LP_TO_BEANS,
UNRIPE_BEANS_TO_UNRIPE_LP,
UNRIPE_LP_TO_UNRIPE_BEANS,
LAMBDA_LAMBDA,
BEANS_TO_WELL_LP,
WELL_LP_TO_BEANS,
UNRIPE_TO_RIPE
}

However, in the LibConvert.convert() function, the first conversion in the enum is commented out.

  • https://github.com/Cyfrin/2024-04-beanstalk-2/blob/27ff8c87c9164c1fbff054be5f22e56f86cdf127/protocol/contracts/libraries/Convert/LibConvert.sol#L31-L69

function convert(bytes calldata convertData)
external
returns (
address tokenOut,
address tokenIn,
uint256 amountOut,
uint256 amountIn
)
{
LibConvertData.ConvertKind kind = convertData.convertKind();
​
// if (kind == LibConvertData.ConvertKind.BEANS_TO_CURVE_LP) {
// (tokenOut, tokenIn, amountOut, amountIn) = LibCurveConvert
// .convertBeansToLP(convertData); @audit Commented out
if (kind == LibConvertData.ConvertKind.CURVE_LP_TO_BEANS) {
(tokenOut, tokenIn, amountOut, amountIn) = LibCurveConvert
.convertLPToBeans(convertData);
} else if (kind == LibConvertData.ConvertKind.UNRIPE_BEANS_TO_UNRIPE_LP) {
(tokenOut, tokenIn, amountOut, amountIn) = LibUnripeConvert
.convertBeansToLP(convertData);
} else if (kind == LibConvertData.ConvertKind.UNRIPE_LP_TO_UNRIPE_BEANS) {
(tokenOut, tokenIn, amountOut, amountIn) = LibUnripeConvert
.convertLPToBeans(convertData);
} else if (kind == LibConvertData.ConvertKind.LAMBDA_LAMBDA) {
(tokenOut, tokenIn, amountOut, amountIn) = LibLambdaConvert
.convert(convertData);
} else if (kind == LibConvertData.ConvertKind.BEANS_TO_WELL_LP) {
(tokenOut, tokenIn, amountOut, amountIn) = LibWellConvert
.convertBeansToLP(convertData);
} else if (kind == LibConvertData.ConvertKind.WELL_LP_TO_BEANS) {
(tokenOut, tokenIn, amountOut, amountIn) = LibWellConvert
.convertLPToBeans(convertData);
} else if (kind == LibConvertData.ConvertKind.UNRIPE_TO_RIPE) {
(tokenOut, tokenIn, amountOut, amountIn) = LibChopConvert
.convertUnripeToRipe(convertData);
} else {
revert("Convert: Invalid payload");
}
}

Impact

The BEANS_TO_CURVE_LP conversion cannot be executed.

Tools Used

Manual Review

Recommendations

Uncomment the above code to allow it to be executed.

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational/Invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.