Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

SeasonGettersFacet returns the wrong totalDeltaB

holydevoti0n

Vulnerability Details

According to the docs the totalDeltaB should: Returns the total Delta B across all whitelisted minting liquidity Wells.
But currently, it returns the deltaB from the C.BEAN_ETH_WELL pool.

/**
* @notice Returns the total Delta B across all whitelisted minting liquidity Wells.
*/
function totalDeltaB() external view returns (int256 deltaB) {
// @audit wrong token here. should be wseth, check whether it was submitted before.
deltaB = LibWellMinting.check(C.BEAN_ETH_WELL);
}

Impact

  • SeasonGettersFacet will never return the correct for the totalDeltaB leading any consumer of this function to show the incorrect price.

Tools Used

Manual Review

Recommendations

Include the deltaB from all the whitelisted liquidity wells.

function totalDeltaB() external view returns (int256 deltaB) {
- deltaB = LibWellMinting.check(C.BEAN_ETH_WELL);
+ address[] memory tokens = LibWhitelistedTokens.getWhitelistedWellLpTokens();
+ for (uint256 i = 0; i < tokens.length; i++) {
+ deltaB = deltaB.add(LibWellMinting.check(tokens[i]));
+ }
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

SeasonGettersFacet returns the wrong totalDeltaB

Appeal created

holydevoti0n Submitter
11 months ago
golanger85 Auditor
11 months ago
inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

SeasonGettersFacet returns the wrong totalDeltaB

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.