Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect WETH address in L2

asefewwexa

Line of code

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/libraries/Token/LibWeth.sol#L16

Summary

Incorrect Weth Address for base L2

Vulnerability Details

The weth address is set to constant meaning it cannot be changed. This is a problem because the weth address (0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2) provided is the weth address for L1 but the weth address for Base L2 is different.

address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

Functions in the library LibWeth such as wrap or unwrap will not work as intended.

Impact

Certain functions will be DOSed because of the incorrect address of weth when in context of base L2

Tools Used

manual review

Recommendations

Set the correct weth address for base L2

address constant WETH = 0x4200000000000000000000000000000000000006;
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Hardcoded WETH/WSTETH/USDC/USDT won't be the same on L2's

Appeal created

asefewwexa Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Hardcoded WETH/WSTETH/USDC/USDT won't be the same on L2's

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.