15,000 USDC
Submission Details
Severity:
State changing function doesn't emit events in `MErc20DelegateMadFixer::sweepAll`
Vulnerability Details
State changing functionMErc20DelegateMadFixer::sweepAll doesn't emit events for parameters change of the protocol.
Context:
function sweepAll(address sweeper) external {
/// @dev checks
require(msg.sender == admin, "only admin may sweep all");
EIP20Interface token = EIP20Interface(underlying);
/// @dev take it, take it all
bool success = token.transfer(sweeper, token.balanceOf(address(this)));
require(success, "token sweep failed");
}
Impact
Not adding an event will not facilitate off-chain monitoring when changing system parameters.
Tools Used
Manual Review
Recommendations
Make sure these endpoints emit events as some off-chain agents might be monitoring the protocol for these events.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
39438 USDC / LOC
14,000 USDC
1,000 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.