Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

UsdOracle reverts on tokens which are not wstETH, WETH, Bean

T1MOH

Summary

UsdOracle.sol is ecosystem contract which is used to fetch the Usd price of Token. Problem is that it uses library LibUsdOracle.sol

LibUsdOracle.sol is meant to be used in Diamond's Facet because reads storage associated with oracle configuration per token. It reads storage on all tokens which are not wstETH, WETH, Bean. And obviously such straoge read is incorrect because UsdOracle.sol is standalone contract.

Vulnerability Details

UsdOracle.sol has several functions to return Token : USD price by using LibUsdOracle.sol:

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/ecosystem/oracles/UsdOracle.sol#L14-L28

LibUsdOracle uses function getTokenPriceFromExternal() on most of the tokens. This function reads storage like it's Diamond's Facet, obviously this function will revert because UsdOracle doesn't store Oracle config per Token:
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/libraries/Oracle/LibUsdOracle.sol#L105

function getTokenPriceFromExternal(
address token,
uint256 lookback
) internal view returns (uint256 tokenPrice) {
AppStorage storage s = LibAppStorage.diamondStorage();
@> Implementation memory oracleImpl = s.sys.oracleImplementation[token];
...
}

Impact

UsdOracle doesn't work with some tokens.

Tools Used

Manual Review

Recommendations

Write custom library to use in UsdOracle.sol

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

T1MOH Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

UsdOracle reverts on tokens which are not wstETH, WETH, Bean

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.