Beanstalk is a permissionless fiat stablecoin protocol built on Ethereum. Its primary objective is to incentivize independent market participants to regularly cross the price of 1 Bean over its dollar peg in a sustainable fashion.
Beanstalk is a permissionless fiat stablecoin protocol built on Ethereum. Its primary objective is to incentivize independent market participants to regularly cross the price of 1 Bean over its dollar peg in a sustainable fashion.
Beanstalk does not have any collateral requirements. Beanstalk uses credit instead of collateral to create Bean price stability relative to its value peg of $1. The practicality of using DeFi is currently limited by the lack of decentralized low-volatility assets with competitive carrying costs. Borrowing rates on USD stablecoins have historically been higher than borrowing rates on USD, even when supply increases rapidly. Non-competitive carrying costs are due to collateral requirements.
In particular, the Sun and Silo components of Beanstalk are in scope of this audit. The code in the repository includes the Seed Gauge System upgrade, which upgrades the Silo to autonomously adjust the Grown Stalk issued to holders of various whitelisted tokens. An overview of the Gauge System can be read here.
You can read an overview of how Beanstalk works here.
gm
caller
gm
function to start the next Season.Generally, the audit covers the Silo, the Sun and many of their associated libraries. A couple contracts from the Barn (related to Unripe assets) are also in scope.
Specifically, only the following contracts are in scope.
protocol/
└── contracts/
├── beanstalk/
│ ├── AppStorage.sol
│ ├── barn/
│ │ └── UnripeFacet.sol
│ ├── init/
│ │ ├── InitBipSeedGauge.sol
│ │ └── InitWhitelistStatuses.sol
│ ├── silo/
│ │ ├── BDVFacet.sol
│ │ ├── ConvertFacet.sol
│ │ ├── EnrootFacet.sol
│ │ ├── MigrationFacet.sol
│ │ ├── SiloFacet/
│ │ │ ├── Silo.sol
│ │ │ ├── SiloFacet.sol
│ │ │ ├── SiloGettersFacet.sol
│ │ │ └── TokenSilo.sol
│ │ └── WhitelistFacet/
│ │ ├── WhitelistedFacet.sol
│ │ └── WhitelistedTokens.sol
│ └── sun/
│ ├── GaugePointFacet.sol
│ ├── LiquidityWeightFacet.sol
│ └── SeasonFacet/
│ ├── Oracle.sol
│ ├── SeasonFacet.sol
│ ├── SeasonGettersFacet.sol
│ ├── Sun.sol
│ └── Weather.sol
├── libraries/
│ ├── Convert/
│ │ ├── LibChopConvert.sol
│ │ ├── LibConvert.sol
│ │ ├── LibConvertData.sol
│ │ ├── LibLambdaConvert.sol
│ │ ├── LibUnripeConvert.sol
│ │ └── LibWellConvert.sol
│ ├── LibCases.sol
│ ├── LibChop.sol
│ ├── LibEvaluate.sol
│ ├── LibFertilizer.sol
│ ├── LibGauge.sol
│ ├── LibIncentive.sol
│ ├── LibLockedUnderlying.sol
│ ├── LibUnripe.sol
│ ├── Minting/
│ │ └── LibWellMinting.sol
│ ├── Oracle/
│ │ ├── LibChainlinkOracle.sol
│ │ ├── LibEthUsdOracle.sol
│ │ └── LibUsdOracle.sol
│ ├── Silo/
│ │ ├── LibGerminate.sol
│ │ ├── LibLegacyTokenSilo.sol
│ │ ├── LibSilo.sol
│ │ ├── LibTokenSilo.sol
│ │ ├── LibUnripeSilo.sol
│ │ ├── LibWhitelist.sol
│ │ └── LibWhitelistedTokens.sol
│ └── Well/
│ └── LibWell.sol
└── pipeline/
└── junctions/
└── UnwrapAndSendETH.sol
Beanstalk implements the ERC-2535 Diamond standard. It supports various whitelists for Deposits, Minting, Converts, etc., particularly for LP tokens from Basin.
Blockchains:
Tokens:
Clone repo:
git clone https://github.com/Cyfrin/2024-02-Beanstalk-1
Install dependencies:
cd Beanstalk/protocol
yarn
Add RPC:
export FORKING_RPC=https://eth-mainnet.g.alchemy.com/v2/{RPC_KEY}
Build:
npx hardhat compile
Test:
npx hardhat test
The enrootDeposits
functions do not properly emit ERC-1155 events.
enrootDeposits
updates a user's Unripe Deposits' BDV and issues the corresponding Stalk to the user. The single enrootDeposit
function correctly emits the ERC-1155 events, but the multiple variant incorrectly emits a transferSingle
event to the 0 address for each Deposit. Given the Beanstalk subgraph does not use these events, and cannot be used to harm the protocol, the fix will be implmented in a separate upgrade to Beanstalk.The SeasonFacet
contract is known to be too large to deploy on mainnet (due to LibGerminate
). This will be fixed before the Seed Gauge System is deployed
All findings in the following audit reports
Additional Known Issues as outlined here: Additional Known Issues
Rank | Username | |||||
1 | h holydevoti0n | $24148.12 | 144 | 0 (0) | 2 (1) | 0 |
2 | g | $21798.57 | 144 | 0 (0) | 2 (1) | 0 |
3 | I | $18274.25 | 84 | 0 (0) | 1 (1) | 0 |
4 | 0 | $11825.66 | 98 | 0 (0) | 1 (0) | 2 |
5 | Z Zealynx | $8223.41 | 84 | 0 (0) | 1 (0) | 0 |
6 | L LordOfTerra | $5873.87 | 60 | 0 (0) | 1 (0) | 0 |
7 | B | $4934.05 | 84 | 0 (0) | 1 (0) | 0 |
8 | I Igdbaxe | $4106.72 | 66 | 0 (0) | 1 (0) | 1 |
9 | 0 | $815.36 | 8 | 0 (0) | 0 (0) | 1 |
10 | T TheBlockChainer | $0.00 | 84 | 0 (0) | 0 (0) | 0 |
11 | s secoalba | $0.00 | 84 | 0 (0) | 0 (0) | 0 |