Submission Details
Severity:
Events are missing sender information
Summary
Events triggered by user actions are missing sender information.
Vulnerability Details
There are 12 instances of this issue.
View 12 Instances
File: src/Lender.sol
165: emit PoolBalanceUpdated(poolId, p.poolBalance);
169: emit PoolCreated(poolId, p);
172: emit PoolUpdated(poolId, p);
214: emit PoolMaxLoanRatioUpdated(poolId, maxLoanRatio);
225: emit PoolInterestRateUpdated(poolId, interestRate);
405: emit Repaid(
406: loan.borrower,
407: loan.lender,
408: loanId,
409: loan.debt + lenderInterest + protocolInterest,
410: loan.collateral,
411: loan.interestRate,
412: loan.startTimestamp
413: );
422: emit Borrowed(
423: loan.borrower,
424: pool.lender,
425: loanId,
426: loans[loanId].debt,
427: loans[loanId].collateral,
428: pool.interestRate,
429: block.timestamp
430: );
449: emit AuctionStart(
450: loan.borrower,
451: loan.lender,
452: loanId,
453: loan.debt,
454: loan.collateral,
455: block.timestamp,
456: loan.auctionLength
457: );
507: emit Repaid(
508: loan.borrower,
509: loan.lender,
510: loanId,
511: loan.debt + lenderInterest + protocolInterest,
512: loan.collateral,
513: loan.interestRate,
514: loan.startTimestamp
515: );
533: emit LoanBought(loanId);
577: emit LoanSiezed(
578: loan.borrower,
579: loan.lender,
580: loanId,
581: loan.collateral
582: );
708: emit Refinanced(loanId);
| File Link | Instance Count | Instance Links |
|---|---|---|
| Lender.sol | 12 | 165,169,172,214,225,405,422,449,507,533,577,708 |
Impact
When an event is emitted based on a user's action, not being able to filter based on the address that triggered the event makes event processing more difficult, particularly when msg.sender is not tx.origin.
Tools Used
baudit: a custom static code analysis tool; manual review
Recommendations
Include msg.sender in user-triggered event emissions.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.