LibUnripeConvert.sol :: getBeanAmountOut() incorrectly calculates the amount of BEAN.

Severity

Medium Risk

Relevant GitHub Links

https://github.com/Cyfrin/2024-04-beanstalk-2/blob/27ff8c87c9164c1fbff054be5f22e56f86cdf127/protocol/contracts/libraries/Convert/LibUnripeConvert.sol#L130-L145

Summary

getBeanAmountOut() incorrectly uses C.UNRIPE_BEAN.totalSupply() instead of C.UNRIPE_LP.totalSupply() to calculate the BEAN amount, resulting in an incorrect calculation.

Vulnerability Details

getBeanAmountOut() calculates the amount of BEAN tokens a user would receive per BEAN:3CRV LP provided.

function getBeanAmountOut(uint256 amountIn)
        internal
        view
        returns (uint256 bean)
    {   
        uint256 lp = LibUnripe.unripeToUnderlying(
            C.UNRIPE_LP,
            amountIn,
@>          IBean(C.UNRIPE_BEAN).totalSupply()  
        );
        bean = LibWellConvert.getBeanAmountOut(LibBarnRaise.getBarnRaiseWell(), lp);
        bean = LibUnripe
            .underlyingToUnripe(C.UNRIPE_BEAN, bean)
            .mul(LibUnripe.percentBeansRecapped())
            .div(LibUnripe.percentLPRecapped());
    }

As observed, the calculation in getBeanAmountOut() mistakenly utilizes IBean(C.UNRIPE_BEAN).totalSupply() to determine the LP. However, this line calculates the LP not the BEAN token amount. The correct implementation is using IBean(C.UNRIPE_LP).totalSupply() to next calcualte correctly the desired BEAN token quantity.

Impact

The BEAN token amount obtained is incorrect.

Tools Used

Manual review.

Recommendations

Change IBean(C.UNRIPE_BEAN).totalSupply() for IBean(C.UNRIPE_LP).totalSupply() .

function getBeanAmountOut(uint256 amountIn)
        internal
        view
        returns (uint256 bean)
    {   
        uint256 lp = LibUnripe.unripeToUnderlying(
            C.UNRIPE_LP,
            amountIn,
-          IBean(C.UNRIPE_BEAN).totalSupply()
+          IBean(C.UNRIPE_LP).totalSupply() 
        );
        bean = LibWellConvert.getBeanAmountOut(LibBarnRaise.getBarnRaiseWell(), lp);
        bean = LibUnripe
            .underlyingToUnripe(C.UNRIPE_BEAN, bean)
            .mul(LibUnripe.percentBeansRecapped())
            .div(LibUnripe.percentLPRecapped());
    }