Beanstalk: The Finale

Summary

The LibWstethEthOracle calculates the wstETH:ETH price by aggregating data from four distinct sources: the wstETH:stETH redemption rate, the stETH:ETH Chainlink oracle, the wstETH:ETH Uniswap pool, and a fixed stETH:ETH redemption rate of 1:1. These sources are combined in three different ways to determine the final price. However, the availability of the Chainlink oracle for stETH:ETH, varies across different Layer 2 (L2) networks, impacting the contract's functionality on networks where the oracle is absent.

Vulnerability Details

The core vulnerability arises from the reliance on external data sources, specifically the Chainlink oracle for stETH:ETH, which is not uniformly available across all L2 networks. This inconsistency affects the contract's ability to perform accurate price computations on networks lacking the necessary oracle support.

Impact

The core vulnerability arises from the reliance on external data sources, specifically the Chainlink oracle for stETH:ETH, which is not uniformly available across all L2 networks. The stETH:ETH is available on Ethereum Mainnet, Arbitrum, Optimism and Base. But it isn't available for example on Polygon, Avalanche, etc (ref. to chainlink docs https://docs.chain.link/data-feeds/price-feeds/addresses?network=polygon&page=1&search=stETH%3AETH).
On L2 networks without the required Chainlink oracle, the contract fails to compute the wstETH:ETH price accurately.

Tools Used

Manual review.

Recommendations

Check if the stETH:ETH Chainlink oracle is available for a specific L2 before to deploy.