DeFiHardhatFoundry
250,000 USDC
View results
Submission Details
Severity: low
Invalid

`L2ContractMigrationFacet.addMigratedDepositsToAccount()` uses msg.sender instead of Tractor publisher

Summary

Protocol fetches publisher from Tractor instead of using msg.sender. However in some places still msg.sender is used, which is wrong.

For example here it uses msg.sender to pass value into event. However it will use incorrect address in case function was invoked by Tractor module.
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/beanstalk/silo/L2ContractMigrationFacet.sol#L186

Impact

Incorrect address will be emitted in event.

Tools Used

Manual Review

Recommendations

Use LibTractor._user() instead of msg.sender

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

`L2ContractMigrationFacet.addMigratedDepositsToAccount()` uses msg.sender instead of Tractor publisher in `TransferSingle` event emission

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.