Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

DepositTokens event in PriorityPool does not emit the correct values

josh4324

Summary

According to the event definition, the DepositTokens event is supposed to emit unusedTokensAmount and queuedTokensAmount, but it currently emits toDepositFromStakingPool, toDepositFromQueue which is generated from the unusedTokensAmount and queuedTokensAmount and other parameters.

Impact

Loss of Trust and Transparency

One of the key purposes of emitting events in smart contracts is to provide transparency and ensure all actions within the contract can be tracked and verified by external observers (like users or dApps). If the wrong event is emitted:

  • Users will be misled, which could result in a lack of trust in the contract or the dApp.

  • The emitted logs may show inaccurate or incorrect information, damaging the overall reliability of the system.

Tools Used

Manual Review

Recommendations

function _depositQueuedTokens(uint256 _depositMin, uint256 _depositMax, bytes[] memory _data) internal {
if (poolStatus != PoolStatus.OPEN) revert DepositsDisabled();
​
uint256 strategyDepositRoom = stakingPool.getStrategyDepositRoom();
if (strategyDepositRoom == 0 || strategyDepositRoom < _depositMin) {
revert InsufficientDepositRoom();
}
​
uint256 _totalQueued = totalQueued;
uint256 unusedDeposits = stakingPool.getUnusedDeposits();
​
uint256 canDeposit = _totalQueued + unusedDeposits;
if (canDeposit == 0 || canDeposit < _depositMin) revert InsufficientQueuedTokens();
​
uint256 toDepositFromStakingPool =
MathUpgradeable.min(MathUpgradeable.min(unusedDeposits, strategyDepositRoom), _depositMax);
uint256 toDepositFromQueue = MathUpgradeable.min(
MathUpgradeable.min(_totalQueued, strategyDepositRoom - toDepositFromStakingPool),
_depositMax - toDepositFromStakingPool
);
​
stakingPool.deposit(address(this), toDepositFromQueue, _data);
_totalQueued -= toDepositFromQueue;
​
if (_totalQueued != totalQueued) {
uint256 diff = totalQueued - _totalQueued;
depositsSinceLastUpdate += diff;
sharesSinceLastUpdate += stakingPool.getSharesByStake(diff);
totalQueued = _totalQueued;
}
​
// event DepositTokens(uint256 unusedTokensAmount, uint256 queuedTokensAmount);
- emit DepositTokens(toDepositFromStakingPool, toDepositFromQueue);
+ emit DepositTokens(unusedDeposits, _totalQueued);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DepositTokens event in PriorityPool does not emit the correct values

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

DepositTokens event in PriorityPool does not emit the correct values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.