Beanstalk: The Finale

Summary

In LibUsdOracle.sol if oracleEncoded type 0x02 is passed than there is a possibility that in the uniswap pool both base token and quote token are passed as the same token due to error in conditional

Vulnerability Details

There will be 2 scenarios in 1st the code works correctly but in second it does not work -
(1st scenario where token = token0 of uni pool , 2nd where token = token1)

In the above code snippet first chalinkToken = Token0
now if chainlinkToken(token0) == token(token0) then chainlinkToken = token1
So in the this case the code works fine but consider the below scenario

chainlinkToken = Token0
now if chainlinkToken(token0) != token(token1) then chainlinkToken = token
so now both chainlinkToken & token = token1
& which passes token1= token0 in LibUniswap which getsQuoteAtTick by passing the same token twice

which leads to malfunction price feed if uniswap pool is used

Please note that this is not the same as another vuln submitted by me , as that shows how base & quote token are interchanged but this shows how baseToken = quoteToken

Code snippet-
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/4e0ad0b964f74a1b4880114f4dd5b339bc69cd3e/protocol/contracts/libraries/Oracle/LibUsdOracle.sol#L132-L134

Impact

Malfunctioning price feed

Tools Used

Manual Review

Recommendations

The second conditional used is not required and is the root cause of the problem just one conditional is needed since we are first already setting chainlinkToken = token0 , now if chainlinkToken == token the we should just change it to token1 to make sure both the base and quote token are different.Incorrect conditional in LibUsdOracle leads mal functioning price feeds