Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Issue of Underflow in `stepSun` Function of `Sun` Contract

0xbeastboy

Summary

The Sun contract manages the minting of Beans to various entities and adjusts the supply of Soil based on oracle data and weather conditions. The stepSun function has potential underflow issue.

Vulnerability Details

The issue lies in the calculation s.sys.fields[s.sys.activeField].harvestable - priorHarvestable within the stepSun function. If priorHarvestable (previous harvestable amount) is greater than s.sys.fields[s.sys.activeField].harvestable (current harvestable amount), the subtraction s.sys.fields[s.sys.activeField].harvestable - priorHarvestable could result in a negative number.
See the following code:

function stepSun(int256 deltaB, uint256 caseId) internal {
// Above peg
if (deltaB > 0) {
uint256 priorHarvestable = s.sys.fields[s.sys.activeField].harvestable;
​
C.bean().mint(address(this), uint256(deltaB));
LibShipping.ship(uint256(deltaB));
​
setSoilAbovePeg(s.sys.fields[s.sys.activeField].harvestable - priorHarvestable, caseId);
s.sys.season.abovePeg = true;
}
// Below peg
else {
setSoil(uint256(-deltaB));
s.sys.season.abovePeg = false;
}
}

Impact

If underflow occurs, the setSoilAbovePeg function might receive an incorrect or unexpected value for newHarvestable, leading to incorrect issuance of Soil. This could disrupt the intended economic model of the contract and affect the stability of Soil supply. This underflow can also lead to DOS as it will face continous reverts.

Tools Used

Manual Review

Recommendations

Implement checks to ensure that priorHarvestable is not greater than s.sys.fields[s.sys.activeField].harvestable before performing the subtraction operation. This can prevent underflow by ensuring valid input conditions.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.