Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`LibDibbler.L2_BLOCK_TIME` might be incorrect for some L2 networks.

bladesec

Github link

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/9c7b9fd521ad7cbe65cc788df181887c0eb39c6d/protocol/contracts/libraries/LibDibbler.sol#L41

Summary

The LibDibbler contract uses 2 seconds block time for L2 but it might be incorrect for some L2 networks including Arbitrum.

Vulnerability Details

The LibDibbler contract sets L2_BLOCK_TIME as 2 seconds and uses it in morningTemperature().

File: LibDibbler.sol
41: uint256 private constant L2_BLOCK_TIME = 2;
​
152: function morningTemperature() internal view returns (uint256) {
153: AppStorage storage s = LibAppStorage.diamondStorage();
154: uint256 delta = block.number.sub(s.sys.season.sunriseBlock).mul(L2_BLOCK_TIME).div(
155: L1_BLOCK_TIME
156: );

While checking a documentation, there is no detailed information about the L2 network.

Some Ethereum L2 networks like Optimism have 2 seconds block time but Arbitrum has 0.26 seconds.

Impact

morningTemperature() might work wrongly with an incorrect block time.

Tools Used

Manual Review

Recommendations

We should set a correct block time for the L2 network deployed.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

L2_BLOCK_TIME hardcoded to 2 seconds is not right for most L2's

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

L2_BLOCK_TIME hardcoded to 2 seconds is not right for most L2's

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.