Beanstalk Part 2

Summary

In LibConvert.getMaxAmountIn(), if (tokenIn == C.CURVE_BEAN_METAPOOL && tokenOut == C.BEAN), the function returns LibCurveConvert.lpToPeg(C.CURVE_BEAN_METAPOOL);.

However the lpToPeg() function called from LibCurveConvert returns 0 for the wrong condition.

Vulnerability Details

LibConvert.getMaxAmountIn():

• https://github.com/Cyfrin/2024-04-beanstalk-2/blob/main/protocol%2Fcontracts%2Flibraries%2FConvert%2FLibConvert.sol#L77-L78

According to Developer comment on the LibCurveConvert.lpToPeg(), the function is designed to return 0 if above peg

However the function does quite the opposite.

• https://github.com/Cyfrin/2024-04-beanstalk-2/blob/main/protocol%2Fcontracts%2Flibraries%2FConvert%2FLibCurveConvert.sol#L41-L46

The current condition if (balances[0] <= xp1) checks if the pool is at or below the peg then returns 0, which is the opposite of the intended behavior.

Impact

This could result in incorrect decisions about when to add or remove liquidity. If the function indicates that the pool is at or below peg when it's actually above peg or vise-versa, liquidity may not be added when it's needed to stabilize the pool's price, potentially leading to price volatility and impermanent loss.

Tools Used

Manual Review

Recommendations

To correct this, the condition should be changed to check if the pool is above the peg. This can be done by ensuring that the condition returns 0 when the pool's balance is greater than the amount of BEAN at the peg (xp1).