Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`LibTractor` has an incorrect EIP712 domain separator.

bladesec

Github link

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/9c7b9fd521ad7cbe65cc788df181887c0eb39c6d/protocol/contracts/libraries/LibTractor.sol#L177

Summary

LibTractor has an incorrect EIP712 domain separator.

Vulnerability Details

_domainSeparatorV4() should use EIP712_TYPE_HASH but uses BLUEPRINT_TYPE_HASH wrongly.

bytes32 private constant EIP712_TYPE_HASH =
keccak256(
"EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"
);
bytes32 public constant BLUEPRINT_TYPE_HASH =
keccak256(
"Blueprint(address publisher,bytes data,bytes operatorData,uint256 maxNonce,uint256 startTime,uint256 endTime)"
);
​
function _domainSeparatorV4() internal view returns (bytes32) {
return
keccak256(
abi.encode(
BLUEPRINT_TYPE_HASH, //@audit wrong hash
TRACTOR_HASHED_NAME,
TRACTOR_HASHED_VERSION,
C.getChainId(),
address(this)
)
);
}

So _domainSeparatorV4() returns an incorrect domain separator and will cause the signature verification to fail.

Impact

The permit transactions wouldn't work with the wrong domain separator.

Tools Used

Manual Review

Recommendations

_domainSeparatorV4() should use EIP712_TYPE_HASH instead of BLUEPRINT_TYPE_HASH.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Tractor not compliant to EIP712 requirement because it's using the type hash of the blueprint, not the EIP712Domain

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.