Summary

If an LP token, wrong initialize of oracle storage variables.

Vulnerability Details

function whitelistToken(
address token,
bytes4 selector,
uint32 stalkIssuedPerBdv,
uint32 stalkEarnedPerSeason,
bytes1 encodeType,
bytes4 gaugePointSelector,
bytes4 liquidityWeightSelector,
uint128 gaugePoints,
uint64 optimalPercentDepositedBdv
) internal {
AppStorage storage s = LibAppStorage.diamondStorage();

    // verify the BDV, gaugePoint, and liquidityWeight selector.
    verifyBDVselector(token, encodeType, selector);
    verifyGaugePointSelector(gaugePointSelector);
    verifyLiquidityWeightSelector(liquidityWeightSelector);

    // add whitelist status
    LibWhitelistedTokens.addWhitelistStatus(
        token,
        true, // Whitelisted by default.
        token != address(C.bean()) && !LibUnripe.isUnripe(token), // Assumes tokens that are not Unripe and not Bean are LP tokens.
        selector == LibWell.WELL_BDV_SELECTOR
    );

    // If an LP token, initialize oracle storage variables.
   @>>  if (token != address(C.bean()) && !LibUnripe.isUnripe(token)) {
        s.usdTokenPrice[token] = 1;
        s.twaReserves[token].reserve0 = 1;
        s.twaReserves[token].reserve1 = 1;
    }

    require(s.ss[token].milestoneSeason == 0, "Whitelist: Token already whitelisted");
    // beanstalk requires all whitelisted assets to have a minimum stalkEarnedPerSeeason
    // of 1 (due to the germination update). set stalkEarnedPerSeason to 1 to prevent revert.
    if (stalkEarnedPerSeason == 0) stalkEarnedPerSeason = 1;
    s.ss[token].selector = selector;
    s.ss[token].stalkEarnedPerSeason = stalkEarnedPerSeason;
    s.ss[token].stalkIssuedPerBdv = stalkIssuedPerBdv;
    s.ss[token].milestoneSeason = uint32(s.season.current);
    s.ss[token].encodeType = encodeType;
    s.ss[token].gpSelector = gaugePointSelector;
    s.ss[token].lwSelector = liquidityWeightSelector;
    s.ss[token].gaugePoints = gaugePoints;
    s.ss[token].optimalPercentDepositedBdv = optimalPercentDepositedBdv;

    emit WhitelistToken(
        token,
        selector,
        stalkEarnedPerSeason,
        stalkIssuedPerBdv,
        gaugePointSelector,
        liquidityWeightSelector,
        gaugePoints,
        optimalPercentDepositedBdv
    );
}

Impact

    wrong initialize  of oracle storage variables.

Tools Used

Recommendations

    // If an LP token, initialize oracle storage variables.
   @>>  if (token == address(C.bean()) || LibUnripe.isUnripe(token)) {
        s.usdTokenPrice[token] = 1;
        s.twaReserves[token].reserve0 = 1;
        s.twaReserves[token].reserve1 = 1;
    }