First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`TSwapPool::_addLiquidityMintAndTransfer` is emitting event incorrectly

naman1729

Summary

  • TSwapPool::_addLiquidityMintAndTransfer is emitting event incorrectly and swap the order of parameters in event.

Vulnerability Details

  • The function _addLiquidityMintAndTransfer is emitting event LiquidityAdded with the wrong order of parameters. The event is emitted with the order of parameters as msg.sender, poolTokensToDeposit, wethToDeposit but the correct order should be msg.sender, wethToDeposit, poolTokensToDeposit.

  • This can lead to give the data wrong in off-chain systems

function _addLiquidityMintAndTransfer(
uint256 wethToDeposit,
uint256 poolTokensToDeposit,
uint256 liquidityTokensToMint
) private {
_mint(msg.sender, liquidityTokensToMint);
@> emit LiquidityAdded(msg.sender, poolTokensToDeposit, wethToDeposit);
​
// Interactions
i_wethToken.safeTransferFrom(msg.sender, address(this), wethToDeposit);
i_poolToken.safeTransferFrom(
msg.sender,
address(this),
poolTokensToDeposit
);
}

Impact

  • The event LiquidityAdded is emitted with the wrong order of parameters. This can cause confusion for users and developers.

  • This can lead to give the data wrong in off-chain systems.

Tools Used

  • Manual review

Recommendations

  • Change the code by updating the order of parameters in event.

function _addLiquidityMintAndTransfer(
uint256 wethToDeposit,
uint256 poolTokensToDeposit,
uint256 liquidityTokensToMint
) private {
_mint(msg.sender, liquidityTokensToMint);
- emit LiquidityAdded(msg.sender, poolTokensToDeposit, wethToDeposit);
+ emit LiquidityAdded(msg.sender, wethToDeposit, poolTokensToDeposit);
// Interactions
i_wethToken.safeTransferFrom(msg.sender, address(this), wethToDeposit);
i_poolToken.safeTransferFrom(
msg.sender,
address(this),
poolTokensToDeposit
);
}
Updates

Appeal created

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`LiquidityAdded` event has parameters out of order

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.