DeFiHardhatFoundry
250,000 USDC
View results
Submission Details
Severity: low
Invalid

`getTokenName` function doesn't properly handle tokens with non-string symbols.

Summary

Some tokens do not return a string metadata name/symbol and will always fail when the getTokenName function is queried for them. So querying URI for these tokens will be impossible. Some tokens don't have symbols at all.

Vulnerability Details

The protocol desires to work with all possible ERC-20 tokens, so getting beanstalk ERC1155 should ideally, not be an issue for the protocol. However, if the unpacked token is a token like MKR or the likes, which do not have string names or symbol, but rather are represented in bytes32 format. Some tokens also do not have symbols. These will cause the getTokenName to always fail, since it expects a string parameter.

function getTokenName(address token) internal view returns (string memory tokenString) {
// for unripe LP, return `urLP` given the current unripe name is inaccurate.
if (token == C.UNRIPE_LP) {
tokenString = "urBEANLP";
} else {
tokenString = ERC20(token).symbol();
}
}

Impact

Failure of the getTokenName function will cause the uri function in MetadataFacet.sol to always fails.
The function is also used in the generateImage function, where blackbars are created using the tokenName which also calls the getTokenName function. As a result, generating image for these token types will be impossible.

Tools Used

Manual Review
Weird ERC20 tokens

Recommendations

Recommend wrapping the getTokenName in a try catch block, so if the function fails, a custom string can be returned instead.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational/Gas

Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Appeal created

inh3l Submitter
11 months ago
inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational/Gas

Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.