Beanstalk: The Finale

DeFiHardhatFoundry
250,000 USDC
Ended
Submission Details
Severity: high
Invalid

Locked ETH in PauseFacet.sol

https://github.com/ThomasHeim11/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/diamond/PauseFacet.sol#L15-L44

Summary

This report identifies a potential issue in the PauseFacet contract (PauseFacet.sol) that could lead to locked ETH within the contract. The issue is related to both the pause and unpause functions being marked as payable even though they do not process ETH payments.

Vulnerability Details

The pause and unpause functions within the PauseFacet contract are both marked as payable. These functions are designed for pausing and unpausing the contract and do not expect or require any ETH payments.

If any of these functions are accidentally or intentionally called with a value greater than 0 ETH, the sent ETH will be locked in the contract and inaccessible.

Impact

Loss of funds: Any ETH accidentally or intentionally sent through the pause or unpause functions will be locked in the contract and inaccessible.

Tools Used

Manual code review

Recommendations

Remove the payable modifier from both the pause and unpause functions. These functions currently do not handle ETH payments and making them non-payable will prevent accidental locking of ETH.

If future functionalities within the PauseFacet require ETH payments, implement proper mechanisms to handle them securely. This would involve clearly explaining the purpose of ETH payments within the function and ensuring proper processing and withdrawal for authorized users.

Updates

Community Judging Commences

Community Judging Judge
6 months ago
Community Judgement Published
100% Invalid

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.

Cyfrin
Updraft
CodeHawks
Solodit
Resources
Cyfrin CodeHawks | #160 - Locked ETH in PauseFacet.sol