Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The `DepotFacet` contract uses an incorrect `PIPELINE` address.

bladesec

Github link

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/9c7b9fd521ad7cbe65cc788df181887c0eb39c6d/protocol/contracts/beanstalk/farm/DepotFacet.sol#L21

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/9c7b9fd521ad7cbe65cc788df181887c0eb39c6d/protocol/contracts/beanstalk/farm/DepotFacet.sol#L31

Summary

The DepotFacet contract uses an incorrect PIPELINE address.

Vulnerability Details

The DepotFacet contract uses a PIPELINE address on L1 which is invalid on L2.

contract DepotFacet is Invariable {
// Pipeline V1.0.1
address private constant PIPELINE = 0xb1bE0000C6B3C62749b5F0c92480146452D15423;
​
/**
* @notice Pipe a PipeCall through Pipeline.
* @param p PipeCall to pipe through Pipeline
* @return result PipeCall return value
**/
function pipe(
PipeCall calldata p
) external payable fundsSafu noSupplyIncrease returns (bytes memory result) {
result = IPipeline(PIPELINE).pipe(p);
}

So multiple functions including pipe() wouldn't work properly on L2.

Impact

Multiple functions of the DepotFacet contract wouldn't work properly.

Tools Used

Manual Review

Recommendations

We should set a PIPELINE address as a parameter for L2.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Hardcoded Pipeline address

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Hardcoded Pipeline address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.