Submission Details
Severity:
In 'Airdrop.sol::claim' the emission of the 'TokenClaimed' event should occur after the transfer
Summary
The emission of the 'TokenClaimed' event should occur after the loveToken.transferFrom.
Vulnerability Details
Events should occur after state changes because of the possibility that they fail. If the loveToken.transferFrom fails, the 'TokenClaimed' event would still be included in the transaction's logs. This could cause issues for off-chain indexers that use events to track state changes.
Impact
Event emission before the transfer could cause issues for indexers if the transfer were to fail.
Tools Used
--Foundry
Recommendations
It is recommended to emit the event after the transfer.
_claimedBy[msg.sender] += tokenAmountToDistribute;
- emit TokenClaimed(msg.sender, tokenAmountToDistribute);
loveToken.transferFrom(
address(airdropVault),
msg.sender,
tokenAmountToDistribute
);
+ emit TokenClaimed(msg.sender, tokenAmountToDistribute);
}
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.