DeFiHardhat
21,000 USDC
View results
Submission Details
Severity: low
Invalid

Restrictive Underlying Token Switching and Lack of Event Emission in `switchUnderlyingToken` Function

Summary

The switchUnderlyingToken function requires the balance of underlying tokens to be zero before allowing the switch to a new underlying token. This requirement can be overly restrictive and may somewhat prevent necessary operational actions such as token migrations or upgrades. Additionally, the function does not emit any event upon the switch.

Impact

Low/Informational

The zero balance requirement could hinder timely updates or migrations of the underlying token in response to critical issues or upgrades, potentially affecting the system's adaptability and security. The absence of event emission reduces the transparency of the contract's operations, making it harder for users and external systems to track changes.

Proof of Concept

https://github.com/Cyfrin/2024-05-Beanstalk-3/blob/662d26f12ee219ee92dc485c06e01a4cb5ee8dfb/protocol/contracts/beanstalk/barn/UnripeFacet.sol#L347-L354

function switchUnderlyingToken(
address unripeToken,
address newUnderlyingToken
) external payable {
LibDiamond.enforceIsContractOwner();
require(s.u[unripeToken].balanceOfUnderlying == 0, "Unripe: Underlying balance > 0");
LibUnripe.switchUnderlyingToken(unripeToken, newUnderlyingToken);
}

In summary, these are the 2 issues:

  1. Zero Balance Requirement: The function enforces a zero balance of underlying tokens, which may not always be practical or desirable.

  2. Lack of Event Emission: No event is emitted when the underlying token is switched, reducing transparency.

##Tools Used
Manual review

Recommendation

Reconsider allowing the switch of the underlying token with a non-zero balance by implementing a safe migration strategy for the existing underlying assets.
Also, add an event emission to the switchUnderlyingToken function to log changes.

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.