Beanstalk exploit

Exploits

BeanstalkApr 17, 2022

$181M lost#20 on rekt.newsNot recovered

Overview

Lost

$181M

#20 on the rekt.news leaderboard

Came back

Not recovered

Attacked

GovernanceFacet.emergencyCommit

Governance: borrowed voting power

Audit

Unaudited

Ethereum

What happened

Beanstalk let a two-thirds supermajority execute a proposal at once through emergencyCommit, one day after it was proposed, and counted voting power (Stalk) from Silo deposits made in the same transaction. The attacker proposed BIP-18 a day early, then flash-borrowed enough to hold about 70% of Stalk, voted, and executed a proposal that sent the protocol's assets to them, all in one transaction.

governanceflash loanvoting powerno timelock

Timeline

Apr 16, 2022BIP-18 (send the assets to the attacker) and BIP-19 (a donation to Ukraine) are proposed.
Apr 17, 2022One transaction: flash loans, deposit, vote, emergencyCommit. $181M of damage.

Attack flow

Votes borrowed for one transactionmissing check

Attacker

Lenders

Curve

Silo

Governance

What happens

1
propose()
Governance.propose
A day earlier: proposes BIP-18, whose code sends the protocol's assets to the attacker's contract. emergencyCommit becomes possible one day later.
2
flashLoan()
Lenders.flashLoan
Borrows about $1B of DAI, USDC, USDT, BEAN and LUSD for one transaction.
3
add_liquidity()
Curve.add_liquidity
Adds them to Curve pools and receives LP tokens.
4
deposit()
Silo.deposit
Deposits the LP tokens into the Silo. Stalk, the voting power, is credited at once: about 70% of all Stalk.
Missing check. Voting power counted from a deposit made in this same transaction: no snapshot, no lock.
5
vote()
Governance.vote
Votes for BIP-18 with the borrowed Stalk.
6
emergencyCommit()
Governance.emergencyCommit
With more than two-thirds of Stalk behind it and a day since the proposal, BIP-18 executes immediately: the protocol's assets move to the attacker.
Missing check. A supermajority could execute at once: no delay between the vote and the execution.
7
remove_liquidity()
Curve.remove_liquidity
Removes the liquidity.
8
repay()
Lenders.repay
Repays the flash loans and keeps the rest, about $76M, sent on through Tornado Cash.

Funds

Balance changes and fund flow, from the sources

PartyAssetValueNet

BeanstalkLostrekt.news's count of the damage.Protocol assets−$181M−$181M

Attacker, keptGainedSent on through Tornado Cash.+24.8k WETH+$76M+$76M

Ukraine donation address (BIP-19)GainedDonation+$250K+$250K

Fund flow, in order

[1] $76M kept[2] $250K

Beanstalk−$181M

Attacker, kept+$76M

Ukraine donation address (BIP-19)+$250K

Root cause

GovernanceFacet (Beanstalk) · illustrative, written to the pattern

11function vote(uint32 bip) external {

2− // the caller's Stalk right now, deposits from this transaction included

3− uint256 stalk = balanceOfStalk(msg.sender);

2+ // weight as of the proposal's snapshot: borrowed for one transaction, it counts for nothing

3+ uint256 stalk = balanceOfStalkAt(msg.sender, snapshotOf(bip));

Missing check. Voting power counted from a deposit made in this same transaction: no snapshot, no lock.

44 recordVote(msg.sender, bip, stalk);

55}

7−function emergencyCommit(uint32 bip) external {

8− require(block.timestamp >= proposedAt(bip) + 1 days, "Governance: Too early.");

9− require(votePercent(bip) >= SUPER_MAJORITY, "Governance: Must have super majority.");

10− _execute(bip); // runs the proposal's code at once

7+function commit(uint32 bip) external {

8+ require(passed(bip), "Governance: Not passed.");

9+ require(block.timestamp >= votingEndedAt(bip) + TIMELOCK, "Governance: Timelocked.");

10+ _execute(bip); // after a delay in which anyone can react

Missing check. A supermajority could execute at once: no delay between the vote and the execution.

1111}

Why it broke

Voting weight was read live, so it could be borrowed and returned within one transaction; and the emergency path removed the delay that would have let anyone react.

Beanstalk's own response was to remove on-chain governance (the GovernanceFacet) in favour of a multisig.

Catch it

Tests of intended behaviour, never attack code

The invariant that would have failed

The weight a vote counts is the weight its voter held at the proposal's snapshot.

As a Foundry test· illustrative, write it against your own contracts

function test_vote_ignoresDepositsAfterTheSnapshot() public {    uint32 bip = _propose();    uint256 before = governance.votingPower(alice, bip);    _deposit(alice, 1_000e18); // after the proposal's snapshot    assertEq(governance.votingPower(alice, bip), before);}

What an auditor checks0/3

Find where voting power comes from. If it is a live balance, it can be borrowed for one transaction: require a snapshot taken before the proposal, or deposits older than it.
Look for any path from a vote to execution inside one transaction, especially emergency paths with a supermajority.
Treat proposals that run arbitrary code as full admin access, and time-lock them.

In Luora. Atlas Paths for vote shows it reading the live Stalk balance. A Foundry test of intended behaviour checks that a deposit made after the snapshot adds no voting weight.

Sources