Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

when shipping, barnReceive can revert in underflow when deltaFertilized > amountToFertilize

asefewwexa

Line of code

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/libraries/LibReceiving.sol#L148

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/libraries/LibReceiving.sol#L14C2-L15C75

Summary

when shipping, barnReceive can revert in underflow causing dos

Vulnerability Details

// There will be up to activeFertilizer Beans leftover Beans that are not fertilized.
// These leftovers will be applied on future Fertilizer receipts.
@ s.sys.fert.leftoverBeans = amountToFertilize - deltaFertilized;

In the above snippet we are updating s.sys.fert.leftoverBeans. The problem occurs when an underflow happens in this calculation due to amountToFertalize < deltaFertalized. Because of the underflow, the call will revert and will cause a DOS.

Becuase this snippet is part of the barnReceive function, the dos will be on the receiving of beans. Therefore the beans will not be able to be received because of this underflow.

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/libraries/LibReceiving.sol#L122

the deltaFertalized is computed below:

deltaFertilized += (firstBpf - oldBpf) * s.sys.fert.activeFertilizer; // fertilizer between init and next cliff

and may be greater than amountToFertilize

* @notice Holds the logic responsible for receiving Bean shipments after mints. These
* functions must be delegatecalled from inside of the Beanstalk Diamond.

Impact

Underflow will cause the tx to revert and not allow the receiving of beans to the contract. DOS

Tools Used

manual review

Recommendations

ensure that deltaFertalized can never be large than amountToFertalize

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.