Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect validation of blueprint in `runBlueprint()`

bladesec

Github link

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/9c7b9fd521ad7cbe65cc788df181887c0eb39c6d/protocol/contracts/beanstalk/farm/TractorFacet.sol#L53

Summary

runBlueprint() validates the block time differently from the document.

Vulnerability Details

In the documentation, it says block.timestamp should be within (startTime, endTime).

Blueprints are off-chain data structures that are EIP-712 signed to verify publisher intent. Each Blueprint contains an arbitrary sequence of internal and external function calls wrapped into an AdvancedFarm call and to be executed through the Tractor Facet. Any properly signed Blueprint can be executed through Tractor given:
​
1. startTime < block.timestamp < endTime;

But runBlueprint() checks differently.

modifier runBlueprint(LibTractor.Requisition calldata requisition) {
require(
LibTractor._getBlueprintNonce(requisition.blueprintHash) <
requisition.blueprint.maxNonce,
"TractorFacet: maxNonce reached"
);
require(
requisition.blueprint.startTime <= block.timestamp && //@audit should be strict
block.timestamp <= requisition.blueprint.endTime,
"TractorFacet: blueprint is not active"
);
}

Recommendations

Recommend implementing like the documentation.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.