QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Valid

UpdateWeightRunnerAddressUpdated event is wrongly emitted when updateWeightRunner is changed

elser17

Summary

UpdateWeightRunnerAddressUpdated event is wrongly emitted when updateWeightRunner is changed

Vulnerability Details

UpdateWeightRunnerAddressUpdated event in QuantAMMWeightedPool contract expects to be emitted with old address and new address as parameters when setUpdateWeightRunnerAddress() function is called. However, it emits twice the new address because it uses the state variable ```updateWeightRunner``` as parameter but this is already updated, failing to emit the previous address.

Impact

Low impact, wrongly emitted event.

Tools Used

Manual review

Recommendations

Correctly emit the event by saving the oldAddress:

function setUpdateWeightRunnerAddress(address _updateWeightRunner) external override {
require(msg.sender == quantammAdmin, "ONLYADMIN");
+ address oldAddress = address(updateWeightRunner);
updateWeightRunner = UpdateWeightRunner(_updateWeightRunner);
- emit UpdateWeightRunnerAddressUpdated(address(updateWeightRunner), _updateWeightRunner);
+ emit UpdateWeightRunnerAddressUpdated(oldAddress, _updateWeightRunner);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_setUpdateWeightRunnerAddress_emit_only_new_address

Likelihood: Low, changing this address is rare. Impact: Low, incorrect event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!