Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing minimum of gas amount will cause transaction to revert

holydevoti0n

Summary

When calling sendMessage(regardless of the L2) gas fees are split into two:

  • Ethereum gas fees (the standard L1 fee)

  • L2 Fees

Docs from optimism about setting the gas limit(this is also valid for most L2s) - https://docs.optimism.io/builders/app-developers/bridging/messaging

Since the gas amount charged is dynamic, the gas burn can change from block to block.
You should always add a buffer of at least 20% to the gas limit for your L1 to L2 transaction to avoid running out of gas.

This means that a transaction can succeed in L1 but fail in L2 if the gas limit is not set properly. Once this happens, the user will lose all the gas fees spent.

Vulnerability Details

function migrateL2Beans(
address reciever,
address L2Beanstalk,
uint256 amount,
@> uint32 gasLimit
) external nonReentrant {
C.bean().burnFrom(msg.sender, amount);
​
​
// send data to
IL2Bridge(BRIDGE).sendMessage(
L2Beanstalk,
abi.encodeCall(IBeanL1RecieverFacet(L2Beanstalk).recieveL1Beans, (reciever, amount)),
@> gasLimit
);
}

Impact

  • The user will lose the money spent on gas fees and will not have his Beans migrated on the first attempt.

Tools Used

Manual Review

Recommendations

Define a minimum amount of gas fees expected to execute the transaction before calling sendMessage, so it guarantees that the transaction will not fail.

Reference: https://docs.optimism.io/builders/app-developers/bridging/messaging

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

holydevoti0n Submitter
about 1 year ago
inallhonesty Lead Judge
12 months ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

If EXTERNAL_L1_BEANS check performed on L2 fails then the burned beans are lost for ever

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.