Reproduced Exploit
Beanstalk Silo — legacy milestone stem decimal mismatch
The upgrade moves gauge points to untruncated precision but leaves historic milestone stems truncated. Stem tip adds those incompatible units and depositors lose accrued grown stalk.
Chain
Other
Category
arithmetic
Date
Dec 2023
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 31276-the-previous-milestone-stem-should-be-scaled-for-use-with-th. Standalone Foundry PoC and full write-up: 31276-the-previous-milestone-stem-should-be-scaled-for-use-with-th_exp in the
evm-hack-registrymirror.
Vulnerability classes: vuln/arithmetic/decimal-mismatch · vuln/logic/state-update
Key info#
| Field | Value |
|---|---|
| Impact | Grown-stalk accounting is understated after upgrade |
| Chain | Local synthetic |
TL;DR#
The upgrade moves gauge points to untruncated precision but leaves historic milestone stems truncated. Stem tip adds those incompatible units and depositors lose accrued grown stalk.
The vulnerable code#
tip = milestoneStem + stalkEarnedPerSeason * (currentSeason - milestoneSeason); // @> VULN: legacy truncated milestoneStem is added to untruncated gauge points without multiplying it by 1e6.
Attack walkthrough#
The PoC uses a legacy stem of 100 and one season of 1,000,000 points. The unscaled result differs from the correctly scaled value by 99,999,900 units.
Diagrams#
Remediation#
During upgrade multiply every prior milestone stem by 1e6 before calculating untruncated stem tips.
Sources#
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 31276-the-previous-milestone-stem-should-be-scaled-for-use-with-th_exp (evm-hack-registry mirror).
- AuditVault finding: 31276-the-previous-milestone-stem-should-be-scaled-for-use-with-th.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.