Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Reentrancy vulnerabilities located in multiple functions that can result in the functions being manipulated.

DuncanDuMond

Summary

Detects reentrancies that allow manipulation of the order or value of events.

Vulnerability Details

Reentrancy in Fertilizer._beforeTokenTransfer(address,address,address,uint256[],uint256[],bytes) (contracts/tokens/Fertilizer/Fertilizer.sol#62-73):
External calls:
- _update(from,ids,bpf) (contracts/tokens/Fertilizer/Fertilizer.sol#71)
- IBS(owner()).payFertilizer(account,amount) (contracts/tokens/Fertilizer/Fertilizer.sol#77)
- _update(to,ids,bpf) (contracts/tokens/Fertilizer/Fertilizer.sol#72)
- IBS(owner()).payFertilizer(account,amount) (contracts/tokens/Fertilizer/Fertilizer.sol#77)
Event emitted after the call(s):
- ClaimFertilizer(ids,beans) (contracts/tokens/Fertilizer/Fertilizer.sol#93)
- _update(to,ids,bpf) (contracts/tokens/Fertilizer/Fertilizer.sol#72)
Reentrancy in Order._cancelPodOrder(Order.PodOrder,LibTransfer.To) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#134-140):
External calls:
- LibTransfer.sendToken(C.bean(),amountBeans,podOrder.orderer,mode) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#137)
Event emitted after the call(s):
- PodOrderCancelled(podOrder.orderer,id) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#139)
Reentrancy in Order._createPodOrder(Order.PodOrder,uint256) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#51-72):
External calls:
- _cancelPodOrder(podOrder,LibTransfer.To.INTERNAL) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#60)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- LibTransfer.sendToken(C.bean(),amountBeans,podOrder.orderer,mode) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#137)
- token.safeTransfer(recipient,amount) (contracts/libraries/Token/LibTransfer.sol#71)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
External calls sending eth:
- _cancelPodOrder(podOrder,LibTransfer.To.INTERNAL) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#60)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
Event emitted after the call(s):
- PodOrderCreated(podOrder.orderer,id,beanAmount,podOrder.fieldId,podOrder.pricePerPod,podOrder.maxPlaceInLine,podOrder.minFillAmount) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#63-71)
Reentrancy in Order._fillPodOrder(Order.PodOrder,address,uint256,uint256,uint256,LibTransfer.To) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#79-129):
External calls:
- LibTransfer.sendToken(C.bean(),costInBeans,filler,mode) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#107)
Event emitted after the call(s):
- PlotTransfer(from,to,index + start,amount) (contracts/beanstalk/market/MarketplaceFacet/PodTransfer.sol#58)
- _transferPlot(filler,podOrder.orderer,podOrder.fieldId,index,start,podAmount) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#113)
- PodOrderFilled(filler,podOrder.orderer,id,podOrder.fieldId,index,start,podAmount,costInBeans) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#119-128)
Reentrancy in LibFertilizer.addFertilizer(uint128,uint256,uint256,uint256) (contracts/libraries/LibFertilizer.sol#43-68):
External calls:
- addUnderlying(tokenAmountIn,fertilizerAmount.mul(DECIMALS),minLP) (contracts/libraries/LibFertilizer.sol#62)
- C.bean().mint(address(this),newDepositedBeans) (contracts/libraries/LibFertilizer.sol#108)
- C.bean().mint(address(this),newDepositedLPBeans) (contracts/libraries/LibFertilizer.sol#114)
- IERC20(barnRaiseToken).transferFrom(LibTractor._user(),address(this),uint256(tokenAmountIn)) (contracts/libraries/LibFertilizer.sol#116-120)
- IERC20(barnRaiseToken).approve(barnRaiseWell,uint256(tokenAmountIn)) (contracts/libraries/LibFertilizer.sol#122)
- C.bean().approve(barnRaiseWell,newDepositedLPBeans) (contracts/libraries/LibFertilizer.sol#123)
- newLP = IWell(barnRaiseWell).addLiquidity(tokenAmountsIn,minAmountOut,address(this),type()(uint256).max) (contracts/libraries/LibFertilizer.sol#131-136)
Event emitted after the call(s):
- SetFertilizer(id,bpf) (contracts/libraries/LibFertilizer.sol#67)
Reentrancy in Fertilizer.beanstalkMint(address,uint256,uint128,uint128) (contracts/tokens/Fertilizer/Fertilizer.sol#47-60):
External calls:
- _update(account,ids,bpf) (contracts/tokens/Fertilizer/Fertilizer.sol#56)
- IBS(owner()).payFertilizer(account,amount) (contracts/tokens/Fertilizer/Fertilizer.sol#77)
- _safeMint(account,id,amount,bytes(0)) (contracts/tokens/Fertilizer/Fertilizer.sol#59)
- response = IERC1155Receiver(to).onERC1155Received(operator,from,id,amount,data) (contracts/tokens/Fertilizer/Fertilizer1155.sol#104-114)
Event emitted after the call(s):
- TransferSingle(operator,address(0),to,id,amount) (contracts/tokens/Fertilizer/Fertilizer1155.sol#86)
- _safeMint(account,id,amount,bytes(0)) (contracts/tokens/Fertilizer/Fertilizer.sol#59)
Reentrancy in MarketplaceFacet.createPodOrder(Order.PodOrder,uint256,LibTransfer.From) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#64-72):
External calls:
- beanAmount = LibTransfer.receiveToken(C.bean(),beanAmount,LibTractor._user(),mode) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#70)
- _createPodOrder(podOrder,beanAmount) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#71)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- LibTransfer.sendToken(C.bean(),amountBeans,podOrder.orderer,mode) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#137)
- token.safeTransfer(recipient,amount) (contracts/libraries/Token/LibTransfer.sol#71)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
External calls sending eth:
- _createPodOrder(podOrder,beanAmount) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#71)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
Event emitted after the call(s):
- InternalBalanceChanged(account,token,delta) (contracts/libraries/Token/LibBalance.sol#95)
- _createPodOrder(podOrder,beanAmount) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#71)
- PodOrderCancelled(podOrder.orderer,id) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#139)
- _createPodOrder(podOrder,beanAmount) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#71)
- PodOrderCreated(podOrder.orderer,id,beanAmount,podOrder.fieldId,podOrder.pricePerPod,podOrder.maxPlaceInLine,podOrder.minFillAmount) (contracts/beanstalk/market/MarketplaceFacet/Order.sol#63-71)
- _createPodOrder(podOrder,beanAmount) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#71)
Reentrancy in MarketplaceFacet.fillPodListing(Listing.PodListing,uint256,LibTransfer.From) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#31-45):
External calls:
- beanAmount = LibTransfer.transferToken(C.bean(),LibTractor._user(),podListing.lister,beanAmount,mode,podListing.mode) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#36-43)
Event emitted after the call(s):
- PlotTransfer(from,to,index + start,amount) (contracts/beanstalk/market/MarketplaceFacet/PodTransfer.sol#58)
- _fillListing(podListing,LibTractor._user(),beanAmount) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#44)
- PodListingFilled(filler,podListing.lister,podListing.fieldId,podListing.index,podListing.start,podReceiveAmount,beanPayAmount) (contracts/beanstalk/market/MarketplaceFacet/Listing.sol#150-158)
- _fillListing(podListing,LibTractor._user(),beanAmount) (contracts/beanstalk/market/MarketplaceFacet/MarketplaceFacet.sol#44)
Reentrancy in SeasonFacet.gm(address,LibTransfer.To) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#48-62):
External calls:
- caseId = calcCaseIdandUpdate(deltaB) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#56)
- C.bean().mint(address(this),sopBeans) (contracts/libraries/Silo/LibFlood.sol#295)
- C.bean().approve(wellDeltaB.well,sopBeans) (contracts/libraries/Silo/LibFlood.sol#298)
- amountOut = IWell(wellDeltaB.well).swapFrom(C.bean(),sopToken,sopBeans,0,address(this),type()(uint256).max) (contracts/libraries/Silo/LibFlood.sol#299-306)
- LibFlood.handleRain(caseId) (contracts/beanstalk/sun/SeasonFacet/Weather.sol#97)
- stepSun(deltaB,caseId) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#59)
- C.bean().mint(address(this),uint256(deltaB)) (contracts/beanstalk/sun/SeasonFacet/Sun.sol#46)
Event emitted after the call(s):
- Receipt(ShipmentRecipient.FIELD,shipmentAmount,data) (contracts/libraries/LibReceiving.sol#94)
- stepSun(deltaB,caseId) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#59)
- Receipt(ShipmentRecipient.SILO,shipmentAmount,abi.encode()) (contracts/libraries/LibReceiving.sol#77)
- stepSun(deltaB,caseId) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#59)
- Receipt(ShipmentRecipient.BARN,shipmentAmount,abi.encode()) (contracts/libraries/LibReceiving.sol#151)
- stepSun(deltaB,caseId) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#59)
- Shipped(s.sys.season.current,beansToShip) (contracts/libraries/LibShipping.sol#78)
- stepSun(deltaB,caseId) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#59)
- Soil(s.sys.season.current,amount.toUint128()) (contracts/beanstalk/sun/SeasonFacet/Sun.sol#83)
- stepSun(deltaB,caseId) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#59)
Reentrancy in SeasonFacet.gm(address,LibTransfer.To) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#48-62):
External calls:
- caseId = calcCaseIdandUpdate(deltaB) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#56)
- C.bean().mint(address(this),sopBeans) (contracts/libraries/Silo/LibFlood.sol#295)
- C.bean().approve(wellDeltaB.well,sopBeans) (contracts/libraries/Silo/LibFlood.sol#298)
- amountOut = IWell(wellDeltaB.well).swapFrom(C.bean(),sopToken,sopBeans,0,address(this),type()(uint256).max) (contracts/libraries/Silo/LibFlood.sol#299-306)
- LibFlood.handleRain(caseId) (contracts/beanstalk/sun/SeasonFacet/Weather.sol#97)
- stepSun(deltaB,caseId) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#59)
- C.bean().mint(address(this),uint256(deltaB)) (contracts/beanstalk/sun/SeasonFacet/Sun.sol#46)
- incentivize(account,mode) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#61)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- token.mint(recipient,amount) (contracts/libraries/Token/LibTransfer.sol#94)
- token.mint(address(this),amount) (contracts/libraries/Token/LibTransfer.sol#96)
- token.safeTransfer(recipient,amount) (contracts/libraries/Token/LibTransfer.sol#71)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
- LibTransfer.mintToken(C.bean(),incentiveAmount,account,mode) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#106)
External calls sending eth:
- incentivize(account,mode) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#61)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
Event emitted after the call(s):
- LibIncentive.Incentivization(account,incentiveAmount) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#108)
- incentivize(account,mode) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#61)
- InternalBalanceChanged(account,token,delta) (contracts/libraries/Token/LibBalance.sol#95)
- incentivize(account,mode) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#61)
Reentrancy in SeasonFacet.incentivize(address,LibTransfer.To) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#92-110):
External calls:
- LibTransfer.mintToken(C.bean(),incentiveAmount,account,mode) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#106)
Event emitted after the call(s):
- LibIncentive.Incentivization(account,incentiveAmount) (contracts/beanstalk/sun/SeasonFacet/SeasonFacet.sol#108)
Reentrancy in LibTransfer.mintToken(IBean,uint256,address,LibTransfer.To) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#95-102):
External calls:
- token.mint(address(this),amount) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#99)
- LibTransfer.sendToken(token,amount,recipient,mode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#100)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- token.safeTransfer(recipient,amount) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#74)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
External calls sending eth:
- LibTransfer.sendToken(token,amount,recipient,mode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#100)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
Event emitted after the call(s):
- InternalBalanceChanged(account,token,delta) (contracts/beanstalk/migration/L1Libraries/LibBalance.sol#88)
- LibTransfer.sendToken(token,amount,recipient,mode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#100)
Reentrancy in LibTransfer.mintToken(IBean,uint256,address,LibTransfer.To) (contracts/libraries/Token/LibTransfer.sol#92-99):
External calls:
- token.mint(address(this),amount) (contracts/libraries/Token/LibTransfer.sol#96)
- LibTransfer.sendToken(token,amount,recipient,mode) (contracts/libraries/Token/LibTransfer.sol#97)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- token.safeTransfer(recipient,amount) (contracts/libraries/Token/LibTransfer.sol#71)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
External calls sending eth:
- LibTransfer.sendToken(token,amount,recipient,mode) (contracts/libraries/Token/LibTransfer.sol#97)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
Event emitted after the call(s):
- InternalBalanceChanged(account,token,delta) (contracts/libraries/Token/LibBalance.sol#95)
- LibTransfer.sendToken(token,amount,recipient,mode) (contracts/libraries/Token/LibTransfer.sol#97)
Reentrancy in LibFlood.sopWell(LibFlood.WellDeltaB) (contracts/libraries/Silo/LibFlood.sol#289-315):
External calls:
- C.bean().mint(address(this),sopBeans) (contracts/libraries/Silo/LibFlood.sol#295)
- C.bean().approve(wellDeltaB.well,sopBeans) (contracts/libraries/Silo/LibFlood.sol#298)
- amountOut = IWell(wellDeltaB.well).swapFrom(C.bean(),sopToken,sopBeans,0,address(this),type()(uint256).max) (contracts/libraries/Silo/LibFlood.sol#299-306)
Event emitted after the call(s):
- SeasonOfPlentyWell(s.sys.season.current,wellDeltaB.well,address(sopToken),amountOut) (contracts/libraries/Silo/LibFlood.sol#308-313)
Reentrancy in Sun.stepSun(int256,uint256) (contracts/beanstalk/sun/SeasonFacet/Sun.sol#41-57):
External calls:
- C.bean().mint(address(this),uint256(deltaB)) (contracts/beanstalk/sun/SeasonFacet/Sun.sol#46)
Event emitted after the call(s):
- Soil(s.sys.season.current,amount.toUint128()) (contracts/beanstalk/sun/SeasonFacet/Sun.sol#83)
- setSoilAbovePeg(s.sys.fields[s.sys.activeField].harvestable - priorHarvestable,caseId) (contracts/beanstalk/sun/SeasonFacet/Sun.sol#49)
Reentrancy in TractorFacet.tractor(LibTractor.Requisition,bytes) (contracts/beanstalk/farm/TractorFacet.sol#86-124):
External calls:
- results[i_scope_0] = LibFarm._advancedFarm(calls[i_scope_0],results) (contracts/beanstalk/farm/TractorFacet.sol#121)
Event emitted after the call(s):
- Tractor(msg.sender,requisition.blueprintHash) (contracts/beanstalk/farm/TractorFacet.sol#123)
Reentrancy in LibTransfer.transferToken(IERC20,address,address,uint256,LibTransfer.From,LibTransfer.To) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#32-48):
External calls:
- amount = receiveToken(token,amount,sender,fromMode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#45)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
- token.safeTransferFrom(sender,address(this),amount - receivedAmount) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#67)
- sendToken(token,amount,recipient,toMode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#46)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- token.safeTransfer(recipient,amount) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#74)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
External calls sending eth:
- amount = receiveToken(token,amount,sender,fromMode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#45)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
- sendToken(token,amount,recipient,toMode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#46)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
Event emitted after the call(s):
- InternalBalanceChanged(account,token,delta) (contracts/beanstalk/migration/L1Libraries/LibBalance.sol#88)
- sendToken(token,amount,recipient,toMode) (contracts/beanstalk/migration/L1Libraries/LibTransfer.sol#46)
Reentrancy in LibTransfer.transferToken(IERC20,address,address,uint256,LibTransfer.From,LibTransfer.To) (contracts/libraries/Token/LibTransfer.sol#29-45):
External calls:
- amount = receiveToken(token,amount,sender,fromMode) (contracts/libraries/Token/LibTransfer.sol#42)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
- token.safeTransferFrom(sender,address(this),amount - receivedAmount) (contracts/libraries/Token/LibTransfer.sol#64)
- sendToken(token,amount,recipient,toMode) (contracts/libraries/Token/LibTransfer.sol#43)
- returndata = address(token).functionCall(data) (node_modules/@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol#96)
- token.safeTransfer(recipient,amount) (contracts/libraries/Token/LibTransfer.sol#71)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
External calls sending eth:
- amount = receiveToken(token,amount,sender,fromMode) (contracts/libraries/Token/LibTransfer.sol#42)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
- sendToken(token,amount,recipient,toMode) (contracts/libraries/Token/LibTransfer.sol#43)
- (success,returndata) = target.call{value: value}(data) (node_modules/@openzeppelin/contracts/utils/Address.sol#87)
Event emitted after the call(s):
- InternalBalanceChanged(account,token,delta) (contracts/libraries/Token/LibBalance.sol#95)
- sendToken(token,amount,recipient,toMode) (contracts/libraries/Token/LibTransfer.sol#43)
​

Impact

Tools Used

Slither

Recommendations

Apply the check-effects-interactions pattern in the functions listed above.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality
Assigned finding tags:

Quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.