EBIP-3: Pod Listing Cancellation

Committed: October 25, 2022

• Submitter
• Emergency Process Note
• Links
• Problem
• Solution
• Contract Changes
• Effective

Submitter

Beanstalk Community Multisig

Emergency Process Note

Per the process outlined in the BCM Emergency Response Procedures, an emergency hotfix may be implemented by an emergency vote of the BCM if the bug is minor and does not require significant code changes.

This bug was reported by a whitehat on Immunefi.

Links

• GitHub Commit Hash: b2b7b6af2913dda868030fba4947575258583c69
• GitHub PR
• Gnosis Transaction
• Etherscan Transaction

Problem

Farmers could cancel Pod Listings on behalf of Farmers by calling the fillPodListing(...) function with an input beanAmount = 0.

This bug would not have resulted in any loss of funds.

Solution

Add the following check: require(amount > 0, "Marketplace: Must fill > 0 Pods.");

The fix has been reviewed by Halborn.

Contract Changes

The following callable functions are modified in Beanstalk:

Effective

Effective immediately upon commit by the BCM, which has already happened.