Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Fertilizer ERC1155s cannot be burned

merklemore

Summary

Fertilizer ERC1155s cannot be burned.

Vulnerability Details

Feritlizer ERC1155 is a standard token implementation, hence it can be minted, transferred and approved. It however cannot be burned, making the tokens miss an important token functionality. This is the _burn function in the inherited ERC1155Upgradeable.sol is internal and the external safeTransferFrom and safeBatchTransferFrom functions do not allow transfer to zero address.

function safeTransferFrom(
address from,
address to,
uint256 id,
uint256 amount,
bytes memory data
) public virtual override {
require(to != address(0), "ERC1155: transfer to the zero address");
require(
from == _msgSender() || isApprovedForAll(from, _msgSender()),
"ERC1155: caller is not owner nor approved"
);
​
address operator = _msgSender();
​
_beforeTokenTransfer(
operator,
from,
to,
__asSingletonArray(id),
__asSingletonArray(amount),
data
);
​
_transfer(from, to, id, amount);
​
emit TransferSingle(operator, from, to, id, amount);
​
__doSafeTransferAcceptanceCheck(operator, from, to, id, amount, data);
}

As a result, any user or external integrations whose functionality requires burning the fertilizers will not be able to do so.

Impact

Users or external integrations that want to burn their fertilizers will not be able to.

Tools Used

Manual Code Review

Recommendations

Recommend exposing the burn and burnBatch functions, or removing the zero address checks in the safeTransferFrom functions (although this method is not made mandatory by the EIP standard).

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational/Gas

Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.