Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The `noOutFlow` invariant is broken in the implementation

oxtenma
## Line of code
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/beanstalk/Invariable.sol#L88
​
## Vulnerability details
The `Invariable::noOutFlow()` is used to verify that the token balances and Stalk doesn't decrease. In the current implementation, the opposite is done with the verification of token balances. Here,
​
```solidity
require(
initialProtocolTokenBalances[i] <= finalProtocolTokenBalances[i],
"INV: noOutFlow Token balance decreased"
);
```
If the `initialProtocolTokenBalances` is less than the `finalProtocolTokenBalances` then the protocol is balance should be decreasing in this modifier, which goes against the invariant tokens balance of the protocol shouldn't decrease.
​
```solidity
modifier noOutFlow() {
uint256 initialStalk = LibAppStorage.diamondStorage().sys.silo.stalk;
address[] memory tokens = getTokensOfInterest();
uint256[] memory initialProtocolTokenBalances = getTokenBalances(tokens);
_;
uint256[] memory finalProtocolTokenBalances = getTokenBalances(tokens);
​
require(
LibAppStorage.diamondStorage().sys.silo.stalk >= initialStalk,
"INV: noOutFlow Stalk decreased"
);
for (uint256 i; i < tokens.length; i++) {
require(
initialProtocolTokenBalances[i] <= finalProtocolTokenBalances[i],
"INV: noOutFlow Token balance decreased"
); // @audit initial balance decreasing here?
}
}
```
## Impact
The invariant of `noOutFlow` isn't properly enforced, due to which the functions such as `siloFacet::deposit()`,`MarketplaceFacet::createPodOrder` using this modifier won't be effective.
​
## Tools Used
Manual Review
## Recommendation
```diff
modifier noOutFlow() {
uint256 initialStalk = LibAppStorage.diamondStorage().sys.silo.stalk;
address[] memory tokens = getTokensOfInterest();
uint256[] memory initialProtocolTokenBalances = getTokenBalances(tokens);
_;
uint256[] memory finalProtocolTokenBalances = getTokenBalances(tokens);
​
require(
LibAppStorage.diamondStorage().sys.silo.stalk >= initialStalk,
"INV: noOutFlow Stalk decreased"
);
+ for (uint256 i; i < tokens.length; i++) {
+ require(
+ initialProtocolTokenBalances[i] >= finalProtocolTokenBalances[i],
"INV: noOutFlow Token balance decreased"
);
}
}
```
```
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.