Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Re-initialization of the field will revert due to incorrect looping

psb01

Summary

In the contract ReseedField, Function init () will fail to Re-initialize the field as inner loop wrongly increments outer loop variable resulting in wrong calculation of calculatedTotalPods and eventually reverting the transaction.

Vulnerability Details

function init(
MigratedPlotData[] calldata accountPlots,
uint256 totalPods,
uint256 harvestable,
uint256 harvested,
uint256 fieldId,
uint8 initialTemperature
) external {
uint256 calculatedTotalPods;
for (uint i; i < accountPlots.length; i++) {
for (uint j; j < accountPlots[i].plots.length; i++) { // @ incrementing i
uint256 podIndex = accountPlots[i].plots[j].podIndex;
uint256 podAmount = accountPlots[i].plots[j].podAmounts;
s.accts[accountPlots[i].account].fields[fieldId].plots[podIndex] = podAmount;
s.accts[accountPlots[i].account].fields[fieldId].plotIndexes.push(podIndex);
emit MigratedPlot(accountPlots[i].account, podIndex, podAmount);
calculatedTotalPods += podAmount;
}
}

Here in L11 - Incrementing i inside inner loop will cause updating states and incrementing calculatedTotalPods with pods corresponding to only first plot of each account and after iterating through all accounts it will break out of loops with incorrect issuing of plots and wrong calculatedTotalPods value which will not be equal to given totalPods.

require(calculatedTotalPods == totalPods, "ReseedField: totalPods mismatch"); // @ revert

Impact

Field Re-initialization and re-issuing of plots to existing farmers will fail.

Tools Used

Manual review

Recommendations

-- for (uint j; j < accountPlots[i].plots.length; i++)
++ for (uint j; j < accountPlots[i].plots.length; j++)
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Very broken loop in ReseedField::init

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Very broken loop in ReseedField::init

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.