Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Hardcoded WETH, USD address will break implementation on all chains other than Ethereum since Protocol will be migrating to other L2s

kwakudr

Summary

Hardcoded usd and weth address

Vulnerability Details

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/libraries/Oracle/LibUsdOracle.sol#L114C17-L118C14

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/libraries/Token/LibWeth.sol#L15C1-L37C2

library LibWeth {
address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

function wrap(uint256 amount, LibTransfer.To mode) internal {
deposit(amount);
LibTransfer.sendToken(IERC20(WETH), amount, msg.sender, mode);
}
​
​
function unwrap(uint256 amount, LibTransfer.From mode) internal {
amount = LibTransfer.receiveToken(IERC20(WETH), amount, msg.sender, mode);
withdraw(amount);
(bool success, ) = msg.sender.call{value: amount}(new bytes(0));
require(success, "Weth: unwrap failed");
}
​
​
function deposit(uint256 amount) private {
IWETH(WETH).deposit{value: amount}();
}
​
​
function withdraw(uint256 amount) private {
IWETH(WETH).withdraw(amount);
}

}

chainlinkOraclePriceAddress = ChainlinkPriceFeedRegistry(chainlinkRegistry).getFeed(
token,
0x0000000000000000000000000000000000000348
); // 0x0348 is the address for USD
}

Impact

The protocol is will not work on the new or potential supported L2 blockchains due to the hardcoded usd, weth contract address.

Tools Used

Manual Review.

Recommendations

Set usd, weth value from a constructor parameter.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Hardcoded WETH/WSTETH/USDC/USDT won't be the same on L2's

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Hardcoded WETH/WSTETH/USDC/USDT won't be the same on L2's

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.