Beanstalk: The Finale

Summary

Uninitialized state variables in MetadataImage and SeasonGettersFacet.

Vulnerability Details

MetadataImage.s (contracts/beanstalk/metadata/MetadataImage.sol#20) is never initialized. It is used in:
- MetadataFacet.uri(uint256) (contracts/beanstalk/metadata/MetadataFacet.sol#33-83)
SeasonGettersFacet.s (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#31) is never initialized. It is used in:
- SeasonGettersFacet.season() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#38-40)
- SeasonGettersFacet.paused() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#45-47)
- SeasonGettersFacet.time() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#52-54)
- SeasonGettersFacet.abovePeg() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#59-61)
- SeasonGettersFacet.sunriseBlock() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#66-68)
- SeasonGettersFacet.weather() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#73-75)
- SeasonGettersFacet.rain() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#80-82)
- SeasonGettersFacet.plentyPerRoot(uint32,address) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#87-89)
- SeasonGettersFacet.wellOracleSnapshot(address) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#121-123)
- SeasonGettersFacet.getSeedGauge() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#146-148)
- SeasonGettersFacet.getAverageGrownStalkPerBdvPerSeason() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#155-157)
- SeasonGettersFacet.getBeanToMaxLpGpPerBdvRatio() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#163-165)
- SeasonGettersFacet.getBeanToMaxLpGpPerBdvRatioScaled() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#171-173)
- SeasonGettersFacet.getGaugePointsPerBdvForWell(address) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#191-199)
- SeasonGettersFacet.getGrownStalkIssuedPerSeason() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#219-229)
- SeasonGettersFacet.getGrownStalkIssuedPerGp() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#234-249)
- SeasonGettersFacet.getPodRate(uint256) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#254-260)
- SeasonGettersFacet.getDeltaPodDemand() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#274-278)
- SeasonGettersFacet.getGaugePoints(address) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#321-323)
- SeasonGettersFacet.calcGaugePointsWithParams(address,uint256) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#329-334)
- SeasonGettersFacet.getGaugePointsWithParams(address) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#340-370)
- SeasonGettersFacet.getCases() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#380-382)
- SeasonGettersFacet.getSeasonStruct() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#417-419)
- SeasonGettersFacet.getSeasonTimestamp() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#421-423)
- SeasonGettersFacet.getSeedGaugeSetting() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#425-427)
- SeasonGettersFacet.getMaxBeanMaxLpGpPerBdvRatio() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#429-431)
- SeasonGettersFacet.getMinBeanMaxLpGpPerBdvRatio() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#433-435)
- SeasonGettersFacet.getTargetSeasonsToCatchUp() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#437-439)
- SeasonGettersFacet.getPodRateLowerBound() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#441-443)
- SeasonGettersFacet.getPodRateOptimal() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#445-447)
- SeasonGettersFacet.getPodRateUpperBound() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#449-451)
- SeasonGettersFacet.getDeltaPodDemandLowerBound() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#453-455)
- SeasonGettersFacet.getDeltaPodDemandUpperBound() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#457-459)
- SeasonGettersFacet.getLpToSupplyRatioUpperBound() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#461-463)
- SeasonGettersFacet.getLpToSupplyRatioOptimal() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#465-467)
- SeasonGettersFacet.getLpToSupplyRatioLowerBound() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#469-471)
- SeasonGettersFacet.getExcessivePriceThreshold() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#473-475)

Impact

An attacker can create a storage variable, potentially leading to manipulated AppStorage variables.

Tools Used

Slither

Recommendations

Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero to improve code readability.