Submission Details
Severity:
L1 blueprints will be executable on L2 too
Summary
L1 blueprints will be executable on L2 too
Vulnerability Details
Within the TractorFacet, users can provide a blueprint and sign it, which basically allows any user to execute the said actions in the blueprint (only once).
However, since the chainId is not part of the signature, any Blueprint that is executed on L1, will also be executable on the L2 Beanstalk decides to migrate to.
As the terms might then be unfavorable for the blueprint signer, this could allow for malicious executions
Impact
Unexpected results, loss of funds
Tools Used
Manual review
Recommendations
Add chain id to the signature
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Replay attack in case of hard fork - Hardcoded chainId 712
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.