Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`BeanL1RecieverFacet::recieveL1Beans()` method will always revert and cannot be executed normally

joicygiore

Summary

BeanL1RecieverFacet::recieveL1Beans() method will always revert and cannot be executed normally

Vulnerability Details

When the BeanL1RecieverFacet::recieveL1Beans() method is called, it will verify that EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, but due to the uint256 constant EXTERNAL_L1_BEANS = 0, if amount > 0 the method will revert

contract BeanL1RecieverFacet is ReentrancyGuard {
@> uint256 constant EXTERNAL_L1_BEANS = 0;
​
address constant BRIDGE = address(0x4200000000000000000000000000000000000007);
address constant L1BEANSTALK = address(0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5);
​
/**
* @notice migrates `amount` of Beans to L2,
* issued to `reciever`.
*/
function recieveL1Beans(address reciever, uint256 amount) external nonReentrant {
// verify msg.sender is the cross-chain messenger address, and
// the xDomainMessageSender is the L1 Beanstalk contract.
require(
msg.sender == address(BRIDGE) &&
IL2Messenger(BRIDGE).xDomainMessageSender() == L1BEANSTALK
);
@> s.sys.migration.migratedL1Beans += amount;
@> require(
EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans,
"L2Migration: exceeds maximum migrated"
);
C.bean().mint(reciever, amount);
}
}

Impact

BeanL1RecieverFacet::recieveL1Beans() method will always revert and cannot be executed normally

Tools Used

Manual Review

Recommendations

If the value of EXTERNAL_L1_BEANS should change dynamically, it needs to be defined as a variable instead of a constant, and can be adjusted later based on actual needs. If EXTERNAL_L1_BEANS must be a constant as a limit on the total migration amount, modify it to a value that meets your needs.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.