20,000 USDC
View results
Submission Details
Severity: low
Valid

Missing events for critical parameter changing operations by Owner

Summary

Lender.setLenderFee(), Lender.setBorrowerFee() and Lender.setFeeReceiver() are missing events for critical parameters changing operations by Owner.

Vulnerability Details

The Owner can change Lender Fees, Borrower Fees and Fee Receiver at any times which can cause arm to users if they are not aware of the changes when making a new transaction.
These 3 critical functions should emit an event when they are called by the Owner to change critical parameters.

Impact

Users could send a transaction thinking the Lender fees or Borrower fees are the values set at deployment(1000, 50), but since the Owner has changed the values but no events were emitted, the users aren't aware.

Tools Used

Manual review

Recommendations

Emit events and provide time lock for users to react.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!