Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The default gauge point function is not used even if selector of ss.gaugePointImplementation is 0

simon0417

Relevant GitHub Links

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/libraries/LibGauge.sol#L200

Summary

In LibGauge::calcGaugePoints, IGaugePointFacet::defaultGaugePointFunction is supposed to be used as the gauge point function to calculate the gauge points when no gauge point function is provided. However, IGaugePointFacet::defaultGaugePointFunction is never used.

Vulnerability Details

function calcGaugePoints(
AssetSettings memory ss,
uint256 percentDepositedBdv
) internal view returns (uint256 newGaugePoints) {
// if the target is 0, use address(this).
address target = ss.gaugePointImplementation.target;
if (target == address(0)) {
target = address(this);
}
// if no selector is provided, use defaultGaugePointFunction
bytes4 selector = ss.gaugePointImplementation.selector;
if (selector == bytes4(0)) {
@> selector = IGaugePointFacet.defaultGaugePointFunction.selector;
}
​
(bool success, bytes memory data) = target.staticcall(
abi.encodeWithSelector(
@> ss.gaugePointImplementation.selector,
ss.gaugePoints,
ss.optimalPercentDepositedBdv,
percentDepositedBdv
)
);
​
if (!success) return ss.gaugePoints;
assembly {
newGaugePoints := mload(add(data, add(0x20, 0)))
}
}
​

In the function, the selector of IGaugePointFacet::defaultGaugePointFunction is assigned to the variable selector if the selector of ss.gaugePointImplementation is 0. However, it is never used afterward.

Impact

When the function is called without providing the selector of ss.gaugePointImplementation, it will always return the ss.gaugePoints instead of calculating with IGaugePointFacet::defaultGaugePointFunction as planned. This will cause the gauge point to be calculated incorrectly, and the owner of the whitelisted Lp token would receive the wrong amount of Grown stalk if IGaugePointFacet::defaultGaugePointFunction is expected to be used to calculate the gauge point for the new Season.

Tools Used

Manual Review

Recommendations

It can be improved by replacing the ss.gaugePointImplementation.selector in the parameter of the staticcall function with the selector variable.

​
(bool success, bytes memory data) = target.staticcall(
abi.encodeWithSelector(
- ss.gaugePointImplementation.selector,
+ selector,
ss.gaugePoints,
ss.optimalPercentDepositedBdv,
percentDepositedBdv
)
);
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

The default gauge point function is not used even if selector of ss.gaugePointImplementation is 0

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.