Beanstalk: The Finale

Summary

The Fertilizer1155.sol contract in the Beanstalk project contains a potential underflow vulnerability in the safeBatchTransferFrom function. This error occurs when the amount of tokens to be transferred amounts[i] at position i exceeds the sender's (from) balance, leading to inaccurate calculations and potentially causing unintended consequences.

Vulnerability Details

The safeBatchTransferFrom function allows for the transfer of multiple ERC-1155 token types at once. However, within the loop that performs the transfer of each token type, there is no check to verify if the sender's balance is sufficient to perform the transfer:

The internal _transfer function in Fertilizer1155.sol does perform a balance check, but it only checks if the balance of from is greater than or equal to the amount. If the amount is larger than the balance, the subtraction fromBalance - _amount will result in an underflow, causing the new balance of from to become a very large value (close to the maximum value of uint128).

Impact

The token balance of the sender (from) will not be updated accurately, potentially displaying a very large balance, causing confusion and difficulty in tracking assets.

Tools Used

Manual Code Review

Recommendations

a check of the sender's token balance should be added before performing the transfer in the safeBatchTransferFrom function: