Submission Details
Severity:
Emitting incorrect event parameters
Summary
The Lender::refinance() emits incorrect event parameters.
Vulnerability Details
The refinance() emits incorrect event parameters: debt and collateral. Specifically, the debt and collateral variables in question contain amounts related to the new pool, not the previous pool.
function refinance(Refinance[] calldata refinances) public {
for (uint256 i = 0; i < refinances.length; i++) {
...
emit Repaid(
msg.sender,
loan.lender,
loanId,
@> debt,
@> collateral,
loan.interestRate,
loan.startTimestamp
);
...
}
}
https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L680-L681
Impact
The incorrect event logs may cause off-chain services to malfunction.
Tools Used
Manual Review
Recommendations
Emit the loan.debt and loan.collateral variables instead to fix this issue.
function refinance(Refinance[] calldata refinances) public {
for (uint256 i = 0; i < refinances.length; i++) {
...
emit Repaid(
msg.sender,
loan.lender,
loanId,
- debt,
- collateral,
+ loan.debt,
+ loan.collateral,
loan.interestRate,
loan.startTimestamp
);
...
}
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.