Submission Details
Severity:
`L2ContractMigrationFacet.addMigratedDepositsToAccount()` uses msg.sender instead of Tractor publisher
Summary
Protocol fetches publisher from Tractor instead of using msg.sender. However in some places still msg.sender is used, which is wrong.
For example here it uses msg.sender to pass value into event. However it will use incorrect address in case function was invoked by Tractor module.
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/silo/L2ContractMigrationFacet.sol#L186
Impact
Incorrect address will be emitted in event.
Tools Used
Manual Review
Recommendations
Use LibTractor._user() instead of msg.sender
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
`L2ContractMigrationFacet.addMigratedDepositsToAccount()` uses msg.sender instead of Tractor publisher in `TransferSingle` event emission
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.