Submission Details
Severity:
Wrong event parameters
Summary
The Repaid event in the refinance functino emits the wrong parameters.
Vulnerability Details
File: Lender.sol
L676: emit Repaid(
msg.sender,
loan.lender,
loanId,
debt, // @audit - should be `loan.debt` before line 659 where `loans[loanId].debt = debt`
collateral, // @audit - should be `loan.collateral`
loan.interestRate,
loan.startTimestamp
);
https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L676
The debt parameter should be replaced by the value of loan.debt before it is updated at line 659.
The collateral parameter should be replaced by loan.collateral.
Impact
Events with wrong parameter can be misinterpreted by the frontend.
Tools Used
Manual review
Recommendations
The event should be emitted before the state change of Line 659 and apply the modifications indicated.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.