Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Caller of sunrise will loose incentive if calls between (238-240] seconds late.

ashutoshsb

Summary

No incentive given to caller for calling sunrise between (238-240) seconds late.

Vulnerability Details

In contract LibIncentive.sol within function fracExp there is no condition mentioned for case when sunrise is (238-240] seconds late which will left caller with no incentive and return 0 to gm call. below is code snippet of function fracExp

if (secondsLate <= 238) {
return _scaleReward(beans, 10_677_927);
}
} else if (secondsLate <= 270) {
if (secondsLate <= 242) {
return _scaleReward(beans, 11_111_494);
}

Poc

Updated one of the available tests for case when call is 240 seconds late

it("240 seconds after season incentive", async function () {
await setToSecondsAfterHour(240);
await beanstalk.connect(owner).sunrise();
// 5 * 10_892_553
expect(to6("54.462768")).to.be.equal(await bean.balanceOf(owner.address));
});

On running above test will give below error

1) Season
previous balance = 0
240 seconds after season incentive:
​
AssertionError: Expected "54462768" to be equal 0
+ expected - actual
​
{
- "_hex": "0x00"
+ "_hex": "0x033f0930"
"_isBigNumber": true
}

Impact

If sunrise is called instantly without any seconds late then also there will be some base incentive but calling between (238-240] seconds late caller will not get any incentive and will loose incentive amounting around 11 times of base incentive.

Tools Used

Manual review

Recommendations

Update incentive for case when seconds late between (238-240]

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LibIncentive misses `240` case

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LibIncentive misses `240` case

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.