Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

L1 Bean Loss Due to EXTERNAL_L1_BEANS = 0.

0xgenaudits

Summary

There is a critical vulnerability in the blockchain migration process involving Bean tokens. The issue arises due to the
EXTERNAL_L1_BEANS variable being set to 0, causing transactions to revert and resulting in the permanent loss of tokens on L1.

Vulnerability Details

The primary issue is that EXTERNAL_L1_BEANS is set to 0, which causes transactions to revert.
This means that any beans burned on Layer 1 (L1) will not be successfully migrated and will be lost permanently.
This is evident from the constant reversion of the relayMessage function, which leads to the tokens being irretrievable.

link: https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/beanstalk/migration/BeanL1RecieverFacet.sol#L22

contract BeanL1RecieverFacet is ReentrancyGuard {
@>> uint256 constant EXTERNAL_L1_BEANS = 0;
​
address constant BRIDGE = address(0x4200000000000000000000000000000000000007);
address constant L1BEANSTALK = address(0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5);
​
/**
* @notice migrates `amount` of Beans to L2,
* issued to `reciever`.
*/
function recieveL1Beans(address reciever, uint256 amount) external nonReentrant {
// verify msg.sender is the cross-chain messenger address, and
// the xDomainMessageSender is the L1 Beanstalk contract.
require(
msg.sender == address(BRIDGE) &&
IL2Messenger(BRIDGE).xDomainMessageSender() == L1BEANSTALK
);
s.sys.migration.migratedL1Beans += amount;
require(
@>> EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans,
"L2Migration: exceeds maximum migrated"
);
C.bean().mint(reciever, amount);
}
}

Impact

The impact of this vulnerability is severe as it results in the permanent loss of Bean tokens during the migration process.
Every transaction intended to migrate tokens from L1 to L2 will fail, and tokens will be lost forever.

Tools Used

Recommendations

set EXTERNAL_L1_BEANS to proper amount.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.