Beanstalk: The Finale

onERC1155Received() is not called on Silo deposit transfers

Summary

Silo deposit is ECR1155 token where address token || uint96 stem is tokenId.
According to EIP1155 it must call to receiver to ensure he accepts that tokens.

However those safe functions are never called.

Vulnerability Details

I doubt I can in short way prove that functions onERC1155Received() and onERC1155BatchReceived() are never called on transfers via SiloFacet.safeTransferFrom() and SiloFacet.safeBatchTransferFrom() because code flow is too complicated to track.

You can check it on your own, additionally you can search for that functions in project repo to ensure they are not called in Silo part of Beanstalk.

Impact

Silo deposit doesn't conform to EIP1155 standard, potentially breaking internal accounting of receiver.

Tools Used

Manual Review

Recommendations

Call those functions in the end of the transfer according to EIP1155.