Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Underflow issue in `Invariable:getTokenEntitlementsAndBalances`

0xbeastboy

Summary

An underflow vulnerability exists in the Invariable:getTokenEntitlementsAndBalances function, specifically in the line entitlements[i] += (s.sys.fields[j].harvestable - s.sys.fields[j].harvested);. This can occur if s.sys.fields[j].harvestable is less than s.sys.fields[j].harvested, leading to an underflow in subtraction, which can cause incorrect entitlement calculations.

Vulnerability Details

See the following code:

function getTokenEntitlementsAndBalances(
address[] memory tokens
) internal view returns (uint256[] memory entitlements, uint256[] memory balances) {
AppStorage storage s = LibAppStorage.diamondStorage();
entitlements = new uint256[](tokens.length);
balances = new uint256[](tokens.length);
​
for (uint256 i; i < tokens.length; i++) {
entitlements[i] =
s.sys.silo.balances[tokens[i]].deposited +
s.sys.silo.germinating[GerminationSide.ODD][tokens[i]].amount +
s.sys.silo.germinating[GerminationSide.EVEN][tokens[i]].amount +
s.sys.internalTokenBalanceTotal[IERC20(tokens[i])];
if (tokens[i] == C.BEAN) {
entitlements[i] +=
(s.sys.fert.fertilizedIndex -
s.sys.fert.fertilizedPaidIndex +
s.sys.fert.leftoverBeans) + // unrinsed rinsable beans
s.sys.silo.unripeSettings[C.UNRIPE_BEAN].balanceOfUnderlying; // unchopped underlying beans
for (uint256 j; j < s.sys.fieldCount; j++) {
entitlements[i] += (s.sys.fields[j].harvestable - s.sys.fields[j].harvested); // unharvested harvestable beans
}
} else if (tokens[i] == LibUnripe._getUnderlyingToken(C.UNRIPE_LP)) {
entitlements[i] += s.sys.silo.unripeSettings[C.UNRIPE_LP].balanceOfUnderlying;
}
entitlements[i] += s.sys.sop.plentyPerSopToken[tokens[i]];
balances[i] = IERC20(tokens[i]).balanceOf(address(this));
}
return (entitlements, balances);
}

Impact

The transaction will revert if underflow occurs, causing a DoS condition for any function relying on this calculation.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, implement checks to ensure that harvestable is always greater than or equal to harvested before performing the subtraction.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational/Gas

Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.