Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`mintFertilizers` maybe revert if account data contains contract address

zhuying

Summary

mintFertilizers maybe revert if account data contains contract address

Vulnerability Details

Fertilizer is ERC1155 token.

for (uint j; j < f.accountData.length; j++) {
// `id` only needs to be set once per account, but is set on each fertilizer
// as `Fertilizer` does not have a function to set `id` once on a batch.
fertilizerProxy.beanstalkMint(
f.accountData[j].account,
fid,
f.accountData[j].amount,
f.accountData[j].lastBpf
); // @audit-check if account is contract address, it's different from the mainnet and minting maybe revert
}
function beanstalkMint(
address account,
uint256 id,
uint128 amount,
uint128 bpf
) external onlyOwner {
if (_balances[id][account].amount > 0) {
uint256[] memory ids = new uint256[](1);
ids[0] = id;
_update(account, ids, bpf);
}
_balances[id][account].lastBpf = bpf;
_safeMint(account, id, amount, bytes("0"));
}

mintFertilizers call beanstalkMint. beanstalkMint call _safeMint.
_safeMint will check if account has onERC1155Received interface. If account hasn't onERC1155Received interface, mint will revert.
So if Fertilizers contains contract address which hasn't onERC1155Received interface, mintFertilizers will revert.
This dune query shows holders of fertilizer have 9 contract address. The contract address in mainnet could be different from L2 (have different bytecodes). We can't make sure the contract address which has onERC1155Received interface in mainnet has onERC1155Received interface in L2s.
If the input of mintFertilizers contains contract address which hasn't onERC1155Received interface, mintFertilizers could revert.

Impact

mintFertilizers could revert if account data contains contract address which hasn't onERC1155Received interface

Tools Used

manual

Recommendations

Delete the contract address data in the input of mintFertilizers.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`_safeMint` can DOSS due to a receiver not implementing `onERC1155Received`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.