First Flight #18: T-Swap

Summary

When the LiquidityAdded event is emitted in the TSwapPool::_addLiquidityMintAndTransfer function, it logs values in an incorrect order. The poolTokensToDeposit value should be in the third parameter position, whereas the wethToDeposit value should be second.

Vulnerability Details

function _addLiquidityMintAndTransfer(...) {
...
emit LiquidityAdded(msg.sender, poolTokensToDeposit, wethToDeposit);
...
}

Impact

Event emission is incorrect, leading to potential malfunction of off-chain functions that rely on the event log for accurate data processing. This can result in data mismatches and potentially erroneous behavior in applications that consume these events.

Tools Used

No specific tools were used to identify this vulnerability.

Recommendations

To fix the issue, switch the positions of the poolTokensToDeposit and wethToDeposit parameters in the emit statement.

• emit LiquidityAdded(msg.sender, poolTokensToDeposit, wethToDeposit);

• emit LiquidityAdded(msg.sender, wethToDeposit, poolTokensToDeposit);

By correcting the order, you ensure that the LiquidityAdded event emits the values in the intended positions, maintaining the integrity and reliability of off-chain functions that process these events.