MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing event on critical changes on L2TokenReceiver::editParams

cryptonoob

Summary

L2TokenReceiver::editParams doesnt emit an event when critical changes are performed so that users and other privileged roles can detect upcoming changes (by offchain monitoring of events) and have the time to react to them.

Vulnerability Details

function editParams(SwapParams memory newParams_) external onlyOwner {
if (params.tokenIn != newParams_.tokenIn) {
TransferHelper.safeApprove(params.tokenIn, router, 0);
TransferHelper.safeApprove(params.tokenIn, nonfungiblePositionManager, 0);
}
if (params.tokenOut != newParams_.tokenOut) {
TransferHelper.safeApprove(params.tokenOut, nonfungiblePositionManager, 0);
}
_editParams(newParams_);
}

Impact

Privileged functions in all contracts have direct financial or trust impact on users who should be given an opportunity to react to them by exiting/engaging without being surprised when changes initiated by such functions are made effective opaquely (without events) and/or immediately (without timelocks).

Tools Used

Manual review

Recommendations

Add events to all possible flows (some flows emit events in callers) and consider adding timelocks to such onlyAdmin functions.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.