Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Beans cannot be migrated from L1 to L2

zanybonzy

Relevant GitHub Links

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/8c8710df547f7d7c5dd82c5381eb6b34532e4484/protocol/contracts/beanstalk/migration/BeanL1RecieverFacet.sol#L22

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/8c8710df547f7d7c5dd82c5381eb6b34532e4484/protocol/contracts/beanstalk/migration/BeanL1RecieverFacet.sol#L40

Summary

Beans cannot be migrated from L1 to L2 due to incorrectly hardcoded EXTERNAL_L1_BEANS value.

Vulnerability Details

BeanL1RecieverFacet.sol has the recieveL1Beans function to receive migrated beans from the migrateL2Beans function in BeanL2MigrationFacet.sol
The function, before minitng to the receiver, first attempts to check if the EXTERNAL_L1_BEANS variable is >= the s.sys.migration.migratedL1Beans and reverts if it's not.

function recieveL1Beans(address reciever, uint256 amount) external nonReentrant {
// verify msg.sender is the cross-chain messenger address, and
// the xDomainMessageSender is the L1 Beanstalk contract.
require(
msg.sender == address(BRIDGE) &&
IL2Messenger(BRIDGE).xDomainMessageSender() == L1BEANSTALK
);
s.sys.migration.migratedL1Beans += amount;
require(
EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans,
"L2Migration: exceeds maximum migrated"
);
C.bean().mint(reciever, amount);
}

The issue however is that the EXTERNAL_L1_BEANS parameter is hardcoded to 0, as a result the function will always fail if a user attempts to migrate more than 0 beans.

uint256 constant EXTERNAL_L1_BEANS = 0;

Impact

Migration cannot occur.

Tools Used

Manual Review

Recommendations

Recommend updating the parameter to a more reasonable value, or allowing it to be setable by the admin.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`EXTERNAL_L1_BEANS` defined with `0` will fail require(EXTERNAL_L1_BEANS >= s.sys.migration.migratedL1Beans, "L2Migration: exceeds maximum migrated");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.