Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing indexed fields in the `OperatorStakingPool` contract.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/OperatorStakingPool.sol#L35

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/OperatorStakingPool.sol#L36

Summary

No event parameters have been indexed in the OperatorStakingPool contract.

Vulnerability Details

In Solidity indexed parameters allow for efficient filtering of logs on the blockchain. This is crucial for off-chain applications that need to monitor specific events; indexed data can be accessed directly from log entries without having to decode the entire event data. However, in the OperatorStakingPool contract, none of the event parameters have been indexed:

contract OperatorStakingPool is Initializable, UUPSUpgradeable, OwnableUpgradeable {
/// ... The rest of code
​
// @audit missing indexing field
@> event Deposit(address account, uint256 amount, uint256 sharesAmount);
@> event Withdraw(address account, uint256 amount, uint256 sharesAmount);
​
/// ... The rest of code
}

Impact

- Difficulty in Filtering: Non-indexed fields cannot be efficiently filtered using the eth_getLogs RPC call or similar methods,

- Limited Search Capabilities: Without indexing, searching for events based on specific values becomes computationally expensive and time-consuming,

- Increased Data Processing: When working with non-indexed fields, off-chain applications often need to fetch and process all relevant events, then filter locally,

- Reduced Real-time Capability: Due to the difficulty in filtering, real-time notifications or updates based on specific event values become challenging to implement.

Tools Used

Manual review.

Recommendations

contract OperatorStakingPool is Initializable, UUPSUpgradeable, OwnableUpgradeable {
/// ... The rest of code
​
// @audit missing indexing field
- event Deposit(address account, uint256 amount, uint256 sharesAmount);
+ event Deposit(address indexed account, uint256 amount, uint256 sharesAmount);
- event Withdraw(address account, uint256 amount, uint256 sharesAmount);
+ event Withdraw(address indexed account, uint256 amount, uint256 sharesAmount);
​
/// ... The rest of code
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.