L2ContractMigrationFacet.sol forgets to set internal balances during migration
Summary
L2ContractMigrationFacet is used to migrate Silo deposits and internal balances owned by smart contracts. Admins of those smart contracts are granted permission to choose recipient and migrate balances and deposits.
Problem is that it never sets internal balances.
Vulnerability Details
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/silo/L2ContractMigrationFacet.sol#L88-L114
It only verifies that user submitted correct balances, but never sets it.
Impact
Smart contracts will lose internal balances after migration to L2.
Tools Used
Manual Review
Recommendations
Add logic to set internal balances to receiver.
Appeal created
Internal balances not migrated
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.