Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Difference with variable decoding between `AdvancedPipeCall` and `AdvancedFarmCall`

draiakoo

Summary

The decoding order of copyReturnIndex, copyByteIndex and pasteByteIndex for AdvancedPipeCall and AdvancedFarmCall is different for the tractor and for the clipboard and can lead to unexpected results

Relevant GitHub Links:

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/libraries/LibBytes.sol#L155-L172
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/libraries/LibBytes.sol#L179-L206

Vulnerability Details

Looking closely to the functions pasteBytesClipboard and pasteBytesTractor we can see that there is a difference when decoding the copyReturnIndex, copyByteIndex and pasteByteIndex.

function pasteBytesClipboard(
bytes32 returnPasteParam, // Copy/paste instructions.
bytes[] memory copyFromDataSet, // data to copy from.
bytes memory pasteToData // Paste destination.
) internal pure {
(uint256 copyReturnIndex, uint256 copyByteIndex, uint256 pasteByteIndex) = decode(
returnPasteParam
);
...
}

As we can see, the function pasteBytesClipboard extract these 3 indexes in the proper order accordingly to the pipeline docs.

evmpipeline docs

However, in the pasteBytesTractor, the copyByteIndex and the copyReturnIndex are swapped. That could lead users to wrongly provide these 2 parameters swapped and get unexpected results in their advanced calls.

function pasteBytesTractor(
bytes32 operatorPasteInstr,
bytes memory copyFromData,
bytes memory pasteToData
) internal view {
// Decode operatorPasteInstr.
(uint80 copyByteIndex, /* copyReturnIndex */, uint80 pasteByteIndex) = decode(operatorPasteInstr);
​
...
}

Impact

Medium

Tools Used

Manual review

Recommendations

Decode the 3 variables in the same order as the docs and the pasteBytesClipboard does.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`pasteBytesTractor` doesn't properly assign the `copyByteIndex` in `decode` line

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.