We were tasked with performing an audit of the Beanstalk codebase and in particular their complete stablecoin protocol implementation.
Over the course of the audit, we were able to pinpoint a significant vulnerability in plot transfers as well as several potentially exploitable attack vectors.
Additionally, we identified certain discrepancies between the whitepaper and the codebase around weather conditions as well as incentive times for BIPs.
The codebase contains code that has been imported from several other projects including Alpha Homora, DyDx and the 0x protocol all of which was validated for any discrepancies and properly documented in case any changes were needed to standardize the code.
Overall, the codebase has been developed to a high standard although it is relatively lackluster in in-line documentation which we urge the Beanstalk team to enhance.
In addition to the security vulnerabilities identified within the report, we have performed an extensive gas optimization analysis of the codebase to attempt to rigorously optimize several aspects of the code all of which have been listed in the respective Code Style chapter.
Post-Audit Conclusion
The Beanstalk team proceeded with applying remediations to all findings in a private codebase that we reviewed and consequently approved for merge with the public development repository.
All findings were either adequately dealt with or provided with sufficient additional material to be considered as nullified with the Beanstalk team assimilating all optimizational exhibits into the codebase wherever applicable.
The codebase of the Beanstalk team can be considered of a very high standard and no outstanding issues remain within the codebase.
During the audit, we filtered and validated a total of 8 findings utilizing static analysis tools as well as identified a total of 68 findings during the manual review of the codebase. We strongly recommend that any minor severity or higher findings are dealt with promptly prior to the project's launch as they introduce potential misbehaviours of the system as well as exploits.
pie
title Total Issues
"Major" : 4
"Medium" : 6
"Minor" : 14
"Informational" : 52
The list below covers each segment of the audit in depth and links to the respective chapter of the report:
