Beanstalk: The Finale

Summary

The return value of an external call is not stored in a local or state variable.

Vulnerability Details

• TokenFacet.transferToken(IERC20,address,uint256,LibTransfer.From,LibTransfer.To) (contracts/beanstalk/farm/TokenFacet.sol#53-61) ignores return value by LibTransfer.transferToken(token,LibTractor._user(),recipient,amount,fromMode,toMode) (contracts/beanstalk/farm/TokenFacet.sol#60)

• TokenFacet.transferInternalTokenFrom(IERC20,address,address,uint256,LibTransfer.To) (contracts/beanstalk/farm/TokenFacet.sol#67-86) ignores return value by LibTransfer.transferToken(token,sender,recipient,amount,LibTransfer.From.INTERNAL,toMode) (contracts/beanstalk/farm/TokenFacet.sol#74-81)

• ReseedBean.mintAndSync(BeanstalkERC20,address,uint256,uint256) (contracts/beanstalk/init/reseed/L2/ReseedBean.sol#213-224) ignores return value by (nonBeanToken,None) = LibWell.getNonBeanTokenAndIndexFromWell(well) (contracts/beanstalk/init/reseed/L2/ReseedBean.sol#220)

• ReseedBean.mintAndSync(BeanstalkERC20,address,uint256,uint256) (contracts/beanstalk/init/reseed/L2/ReseedBean.sol#213-224) ignores return value by IWell(well).sync(address(this),0) (contracts/beanstalk/init/reseed/L2/ReseedBean.sol#222)

• L1TokenFacet.transferToken(IERC20,address,uint256,LibTransfer.From,LibTransfer.To) (contracts/beanstalk/migration/L1TokenFacet.sol#56-72) ignores return value by LibTransfer.transferToken(token,msg.sender,recipient,amount,fromMode,toMode) (contracts/beanstalk/migration/L1TokenFacet.sol#71)

• L1TokenFacet.transferInternalTokenFrom(IERC20,address,address,uint256,LibTransfer.To) (contracts/beanstalk/migration/L1TokenFacet.sol#78-97) ignores return value by LibTransfer.transferToken(token,sender,recipient,amount,LibTransfer.From.INTERNAL,toMode) (contracts/beanstalk/migration/L1TokenFacet.sol#85-92)

• ConvertGettersFacet.calculateStalkPenalty(LibConvert.DeltaBStorage,uint256,uint256,address,address) (contracts/beanstalk/silo/ConvertGettersFacet.sol#105-129) ignores return value by LibConvert.calculateStalkPenalty(dbs,bdvConverted,overallConvertCapacity,inputToken,outputToken) (contracts/beanstalk/silo/ConvertGettersFacet.sol#121-128)

• SiloGettersFacet.getDeposit(address,address,int96) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#73-79) ignores return value by LibTokenSilo.getDeposit(account,token,stem) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#78)

• SiloGettersFacet.getGerminatingTotalDeposited(address) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#100-102) ignores return value by (None,amount) = LibGerminate.getTotalGerminatingForToken(token) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#101)

• SiloGettersFacet.getGerminatingTotalDepositedBdv(address) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#107-109) ignores return value by (_bdv,None) = LibGerminate.getTotalGerminatingForToken(token) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#108)

• SiloGettersFacet.balanceOfStalk(address) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#317-324) ignores return value by (germinatingStalk,None) = LibGerminate.getFinishedGerminatingStalkAndRoots(account,s.accts[account].lastUpdate,s.sys.season.current) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#318-322)

• SiloGettersFacet.balanceOfRoots(address) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#371-378) ignores return value by (None,germinatingRoots) = LibGerminate.getFinishedGerminatingStalkAndRoots(account,s.accts[account].lastUpdate,s.sys.season.current) (contracts/beanstalk/silo/SiloFacet/SiloGettersFacet.sol#372-376)

• SeasonGettersFacet.getLiquidityToSupplyRatio() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#265-269) ignores return value by (l2sr,None,None) = LibEvaluate.calcLPToSupplyRatio(beanSupply) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#267)

• SeasonGettersFacet.getDeltaPodDemand() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#274-278) ignores return value by (deltaPodDemand,None,None) = LibEvaluate.calcDeltaPodDemand(s.sys.beanSown) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#276)

• SeasonGettersFacet.getTwaLiquidityForWell(address) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#283-286) ignores return value by (token,None) = LibWell.getNonBeanTokenAndIndexFromWell(well) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#284)

• SeasonGettersFacet.getLargestLiqWell() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#372-376) ignores return value by (None,well,None) = LibEvaluate.calcLPToSupplyRatio(beanSupply) (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#374)

• SeasonGettersFacet.getWellsByDeltaB() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#477-488) ignores return value by LibFlood.getWellsByDeltaB() (contracts/beanstalk/sun/SeasonFacet/SeasonGettersFacet.sol#487)

• Drafter.decodeOperatorPasteInstr(bytes32) (contracts/ecosystem/Drafter.sol#16-20) ignores return value by LibBytes.decode(operatorPasteInstr) (contracts/ecosystem/Drafter.sol#19)

• Drafter.decodeLibReturnPasteParam(bytes32) (contracts/ecosystem/Drafter.sol#30-34) ignores return value by LibBytes.decode(returnPasteParam) (contracts/ecosystem/Drafter.sol#33)

• Drafter.decodeClipboard(bytes) (contracts/ecosystem/Drafter.sol#43-47) ignores return value by LibClipboard.decode(clipboard) (contracts/ecosystem/Drafter.sol#46)

• LibConvert._withdrawTokens(address,int96[],uint256[],uint256) (contracts/libraries/Convert/LibConvert.sol#440-510) ignores return value by LibSilo.burnActiveStalk(user,a.active.stalk.add(a.active.bdv.mul(s.sys.silo.assetSettings[token].stalkIssuedPerBdv))) (contracts/libraries/Convert/LibConvert.sol#505-508)

• LibPipelineConvert.transferTokensFromPipeline(address) (contracts/libraries/Convert/LibPipelineConvert.sol#135-143) ignores return value by IPipeline(C.PIPELINE).pipe(p) (contracts/libraries/Convert/LibPipelineConvert.sol#142)

• LibPipelineConvert.getConvertState(bytes) (contracts/libraries/Convert/LibPipelineConvert.sol#158-180) ignores return value by (None,None,toToken) = convertData.convertWithAddress() (contracts/libraries/Convert/LibPipelineConvert.sol#169)

• LibPipelineConvert.getConvertState(bytes) (contracts/libraries/Convert/LibPipelineConvert.sol#158-180) ignores return value by (None,None,fromToken) = convertData.convertWithAddress() (contracts/libraries/Convert/LibPipelineConvert.sol#173)

• LibFertilizer.addUnderlying(uint256,uint256,uint256) (contracts/libraries/LibFertilizer.sol#85-143) ignores return value by IERC20(barnRaiseToken).approve(barnRaiseWell,uint256(tokenAmountIn)) (contracts/libraries/LibFertilizer.sol#122)

• LibFertilizer.addUnderlying(uint256,uint256,uint256) (contracts/libraries/LibFertilizer.sol#85-143) ignores return value by C.bean().approve(barnRaiseWell,newDepositedLPBeans) (contracts/libraries/LibFertilizer.sol#123)

• LibFertilizer.beginBarnRaiseMigration(address) (contracts/libraries/LibFertilizer.sol#214-233) ignores return value by LibUsdOracle.getTokenPrice(address(tokens[1])) (contracts/libraries/LibFertilizer.sol#224)

• LibFertilizer.beginBarnRaiseMigration(address) (contracts/libraries/LibFertilizer.sol#214-233) ignores return value by LibUsdOracle.getTokenPrice(address(tokens[0])) (contracts/libraries/LibFertilizer.sol#224)

• LibChainlinkOracle.getPrice(address,uint256) (contracts/libraries/Oracle/LibChainlinkOracle.sol#55-89) ignores return value by (roundId,answer,timestamp) = priceAggregator.latestRoundData() (contracts/libraries/Oracle/LibChainlinkOracle.sol#71-88)

• LibChainlinkOracle.getTwap(address,uint256,uint256) (contracts/libraries/Oracle/LibChainlinkOracle.sol#96-163) ignores return value by (roundId,answer,timestamp) = priceAggregator.latestRoundData() (contracts/libraries/Oracle/LibChainlinkOracle.sol#113-162)

• LibChainlinkOracle.getRoundData(IChainlinkAggregator,uint80) (contracts/libraries/Oracle/LibChainlinkOracle.sol#165-180) ignores return value by (_answer,_timestamp) = priceAggregator.getRoundData(roundId) (contracts/libraries/Oracle/LibChainlinkOracle.sol#169-179)

• LibUniswapOracle.consult(address,uint32) (contracts/libraries/Oracle/LibUniswapOracle.sol#46-69) ignores return value by (tickCumulatives) = IUniswapV3Pool(pool).observe(secondsAgos) (contracts/libraries/Oracle/LibUniswapOracle.sol#56-68)

• LibFlood.sopWell(LibFlood.WellDeltaB) (contracts/libraries/Silo/LibFlood.sol#289-315) ignores return value by C.bean().approve(wellDeltaB.well,sopBeans) (contracts/libraries/Silo/LibFlood.sol#298)

• LibWell.getTwaReservesFromPump(address) (contracts/libraries/Well/LibWell.sol#276-291) ignores return value by (twaReserves) = ICumulativePump(pumps[0].target).readTwaReserves(well,s.sys.wellOracleSnapshots[well],uint40(s.sys.season.timestamp),pumps[0].data) (contracts/libraries/Well/LibWell.sol#279-290)

• LibWell.getTwaLiquidityFromPump(address,uint256) (contracts/libraries/Well/LibWell.sol#299-319) ignores return value by (twaReserves) = ICumulativePump(pumps[0].target).readTwaReserves(well,s.sys.wellOracleSnapshots[well],uint40(s.sys.season.timestamp),pumps[0].data) (contracts/libraries/Well/LibWell.sol#306-318)

• TokenSilo._withdrawDeposit(address,address,int96,uint256) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#190-222) ignores return value by LibSilo.burnActiveStalk(account,grownStalkRemoved) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#219)

• TokenSilo._withdrawDeposits(address,address,int96[],uint256[]) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#234-286) ignores return value by LibSilo.burnActiveStalk(account,ar.grownStalkFromGermDeposits) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#280)

• TokenSilo._withdraw(address,address,uint256,uint256,uint256) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#291-302) ignores return value by LibSilo.burnActiveStalk(account,stalk) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#301)

• TokenSilo._withdrawGerminating(address,address,uint256,uint256,uint256,GerminationSide) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#308-345) ignores return value by LibSilo.burnActiveStalk(account,earnedBeansStalk) (contracts/beanstalk/silo/SiloFacet/TokenSilo.sol#338)

Impact

The return prompt is never executed.

Tools Used

Slither

Recommendations

Ensure that all the return values of the function calls are used.