DeFiHardhatFoundry
250,000 USDC
View results
Submission Details
Severity: medium
Valid

When migrating via `L2ContractMigrationFacet`, user is not minted roots for the newly accrued stalk

Summary

Users lose roots upon migration

Vulnerability Details

When migrating to L2, the user's roots are included in the merkle leaf. If before their migrations seasons have passed and the stemTip has increased, user will be minted extra stalk for it.

uint256 depositId = depositData.depositIds[i];
(address depositToken, int96 stem) = depositId.unpackAddressAndStem();
require(depositToken == depositData.token, "Migration: INVALID_DEPOSIT_ID");
require(stemTip >= stem, "Migration: INVALID_STEM");
// add deposit to account.
s.accts[account].deposits[depositId].amount = depositData.amounts[i];
s.accts[account].deposits[depositId].bdv = depositData.bdvs[i];
// increment totalBdvForAccount by bdv of deposit:
totalBdvForAccount += depositData.bdvs[i];
// increment by grown stalk of deposit.
accountStalk += uint96(stemTip - stem) * depositData.bdvs[i];

Usually, when stalk is minted, roots are also minted at the current silo ratios. However, this will not be the case here.

As users will be minted less roots, this will make the overall roots : stalk ratio higher, which will on its own allow for unfair minting of Beans via plant for all other users

Impact

Loss of roots, unfair minting of Beans

Tools Used

Manual review

Recommendations

Mint extra roots depending on the newly minted stalk

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Root loss via L2ContractMigrationFacet migration

Appeal created

deadrosesxyz Submitter
about 1 year ago
giovannidisiena Auditor
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Root loss via L2ContractMigrationFacet migration

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.