15,000 USDC
Submission Details
Severity:
Events must be emitted before external calls
Summary
Events must be emitted before external calls
Vulnerability Details
Emit events before external calls MErc20DelegateFixer.sol
function repayBadDebtWithCash(uint256 amount) external nonReentrant {
/// Checks and Effects
badDebt = SafeMath.sub(badDebt, amount, "amount exceeds bad debt");
EIP20Interface token = EIP20Interface(underlying);
/// Interactions
require(
token.transferFrom(msg.sender, address(this), amount),
"transfer in failed"
);
emit BadDebtRepayed(amount);
}
Impact
Can lead to events being emitted out of order
Tools Used
Manual Analysis
Recommendations
Recommended emit events first before external calls e.g transfers etc
function repayBadDebtWithCash(uint256 amount) external nonReentrant {
/// Checks and Effects
badDebt = SafeMath.sub(badDebt, amount, "amount exceeds bad debt");
EIP20Interface token = EIP20Interface(underlying);
emit BadDebtRepayed(amount);
/// Interactions
require(
token.transferFrom(msg.sender, address(this), amount),
"transfer in failed"
);
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
39438 USDC / LOC
14,000 USDC
1,000 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.