Beanstalk Notion
Beanstalk Notion
/
🪲
Bug Reports
/
BIC Notes
/
📄
Report #32140
📄

Report #32140

Report Date
June 10, 2024
Status
Closed
Payout

Proxy Upgradeability

‣
Report Info

Report ID

#32140

Report type

Smart Contract

Has PoC?

Yes

Target

https://etherscan.io/address/0x402c84de2ce49af88f5e2ef3710ff89bfed36cb6

Impacts

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Description

The problem with the Proxy Upgradeability bug is that it allows unauthorized access to upgrade the implementation contract, potentially leading to unauthorized changes in the system. If this bug is exploited in production/mainnet, it could result in security vulnerabilities, loss of funds, manipulation of data, or disruption of normal operations. It is crucial to address this bug promptly to ensure the integrity and security of the system.

Vulnerability Details

The vulnerability in Proxy Upgradeability refers to a potential security flaw in smart contracts that utilize proxy patterns for upgradability. When implementing proxy upgradeability, there is a risk of introducing unintended behavior or allowing unauthorized upgrades. If this vulnerability is exploited in production/mainnet, it could lead to unauthorized modifications of the contract's logic, potentially compromising the integrity and security of the contract and its associated assets. It is crucial to thoroughly review and test proxy upgradeable contracts to ensure they are properly secured and protected against potential exploits.

Impact Details

In the case of a vulnerability related to Proxy Upgradeability, the potential losses from an exploit can vary depending on the specific circumstances and the assets involved. However, the consequences can be severe. If an attacker successfully exploits the vulnerability, they may be able to gain unauthorized access to critical functions or manipulate the behavior of the smart contract. This could result in unauthorized transfers of funds, manipulation of data, or even the complete loss of assets held within the contract. The impact of such an exploit can be significant, potentially leading to financial losses for individuals or organizations using the affected smart contract. It is crucial to address this vulnerability promptly to mitigate the potential risks and protect the assets at stake.

References

Exploit Example

  • Bent Finance (BENT)
  • Meerkat Finance (MKAT)

Proof of concept

0xfECB01359263C12Aa9eD838F878A596F0064aa6e Proxy upgradeability: TransparentUpgradeableProxy.upgradeToAndCall(address,bytes) (TransparentUpgradeableProxy.sol#102-104)

function upgradeToAndCall(address newImplementation, bytes calldata data) external payable ifAdmin {
    _upgradeToAndCall(newImplementation, data, true);
}

0xfECB01359263C12Aa9eD838F878A596F0064aa6e Proxy upgradeability: TransparentUpgradeableProxy.upgradeTo(address) (TransparentUpgradeableProxy.sol#91-93)

function upgradeTo(address newImplementation) external ifAdmin {
    _upgradeToAndCall(newImplementation, bytes(""), false);
}

Immunefi Response

We have reviewed your submission, but unfortunately, we are closing the report for the following reasons:
  • The submission contains the output of an automated scanner without demonstrating that it is a valid issue.
  • The submission lacks the required information regarding the vulnerability's impact on the reported asset.

As per the bug bounty program's policy, we require all submissions to be accompanied by a Proof of Concept (PoC) that demonstrates the vulnerability's existence and impact. Since the submission doesn't provide any proof of the vulnerability's existence, we have decided to close it.

Please note that the project will receive a report of the closed submission and may choose to re-open it, but they are not obligated to do so.