Beanstalk Part 3
Beanstalk
DeFiHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

```LibUnripe::getTotalRecapitalizedPercent``` returns wrong ```recapitalizedPercent``` if ```totalUsdNeeded``` is 0

kiteweb3

Summary

The LibUnripe::getTotalRecapitalizedPercent is designed to returns the total percentage that beanstalk has recapitalized (recapitalizedPercent). This calculation is based on the ratio of the amount recapitalized (s.recapitalized) to the total dollar amount needed to recapitalize Beanstalk (totalUsdNeeded). The function contains a conditional statement for handling the scenario where if totalUsdNeeded is equal to 0 returns 0.

In the case of totalUsdNeeded is equal to 0, meaning the recapitalization is completed, the recapitalizedPercent should be 100% but the function returns 0.

As indicated in the natspec comment "@dev this is calculated by the ratio of s.recapitalized and the total dollars the barnraise needs to raise returns the same precision as getRecapPaidPercentAmount (100% recapitalized = 1e6)". So the if statement in the function should return 1e6 (100% recapitalized).

Vulnerability Details

function getTotalRecapitalizedPercent() internal view returns (uint256 recapitalizedPercent) {
AppStorage storage s = LibAppStorage.diamondStorage();
uint256 totalUsdNeeded = LibFertilizer.getTotalRecapDollarsNeeded();
@> if(totalUsdNeeded == 0) return 0;
return s.recapitalized.mul(DECIMALS).div(totalUsdNeeded);
}

Impact

The LibUnripe::getTotalRecapitalizedPercent is designed to returns the total percentage that beanstalk has recapitalized (recapitalizedPercent). In the case of the total dollar amount needed to recapitalize Beanstalk is 0 (totalUsdNeeded==0), the recapitalizedPercent should be 100% (all recapitalized) and not 0 as returned by the if statement into the function. This function is called in several get functions (UnripeFacet::getLockedBeansUnderlyingUnripeBean, UnripeFacet::getPercentPenalty, etc), returning a wrong result in the case of totalUsdNeeded==0).

Tools Used

Manual review

Recommendations

function getTotalRecapitalizedPercent() internal view returns (uint256 recapitalizedPercent) {
AppStorage storage s = LibAppStorage.diamondStorage();
uint256 totalUsdNeeded = LibFertilizer.getTotalRecapDollarsNeeded();
- if(totalUsdNeeded == 0) return 0;
+ if(totalUsdNeeded == 0) return 1e6;
return s.recapitalized.mul(DECIMALS).div(totalUsdNeeded);
}
Updates

Lead Judging Commences

giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Recapitalized percent

pontifex Judge
over 1 year ago
kiteweb3 Submitter
over 1 year ago
giovannidisiena Lead Judge
over 1 year ago
giovannidisiena Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Recapitalized percent

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.