Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

BeanL1RecieverFacet::recieveL1Beans will always revert when it is called

simon0417

Relevant Github Link

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/beanstalk/migration/BeanL1RecieverFacet.sol#L40

Summary

The function BeanL1RecieverFacet::recieveL1Beans will always revert because the variable BeanL1RecieverFacet::EXTERNAL_L1_BEANS, which represents the maximum amount of beans that can be migrated to L2, is set to 0. This causes the function to always revert when called.

Vulnerability Details

The variable BeanL1RecieverFacet::EXTERNAL_L1_BEANS is set to 0, while the function BeanL1RecieverFacet::recieveL1Bean requires s.sys.migration.migratedL1Beans to be less than or equal to BeanL1RecieverFacet::EXTERNAL_L1_BEANS to proceed with execution. As a result, the function will only execute without reverting if s.sys.migration.migratedL1Beans is equal to 0.

​
@> uint256 constant EXTERNAL_L1_BEANS = 0;
​
function recieveL1Beans(address reciever, uint256 amount) external nonReentrant {
// verify msg.sender is the cross-chain messenger address, and
// the xDomainMessageSender is the L1 Beanstalk contract.
require(
msg.sender == address(BRIDGE) &&
IL2Messenger(BRIDGE).xDomainMessageSender() == L1BEANSTALK
);
s.sys.migration.migratedL1Beans += amount;
require(
@> EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans,
"L2Migration: exceeds maximum migrated"
);
C.bean().mint(reciever, amount);
}
​

Impact

Beans can never be migrated from L1 to L2 as the function BeanL1RecieverFacet::recieveL1Beans would always revert.

Tools Used

Manual review

Recommendations

Set the variable BeanL1RecieverFacet::EXTERNAL_L1_BEANS to a large enough value to allow the function BeanL1RecieverFacet::recieveL1Beans to work as expected.

​
- uint256 constant EXTERNAL_L1_BEANS = 0
+ uint256 constant EXTERNAL_L1_BEANS = SUITABLE_VALUE;
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.