Submission Details
Severity:
Wrong address emitted in UpdateWeightRunnerAddressUpdated event
Summary
The UpdateWeightRunnerAddressUpdated event in QuantAMMWeightedPool emits the new address twice instead of tracking the change from old to new address.
Vulnerability Details
This is the event declaration:
///@dev Emitted when the update weight runner is updated
event UpdateWeightRunnerAddressUpdated(address indexed oldAddress, address indexed newAddress);
And this is the function emitting the wrong address for the old runner address:
function setUpdateWeightRunnerAddress(address _updateWeightRunner) external override {
require(msg.sender == quantammAdmin, "ONLYADMIN");
// @audit Should store old address before update
updateWeightRunner = UpdateWeightRunner(_updateWeightRunner);
// @audit Both params are identical
emit UpdateWeightRunnerAddressUpdated(address(updateWeightRunner), _updateWeightRunner);
}
Impact
Low severity as it will cause issues in off-chain monitoring and indexing.
Tools Used
Manual code review
Recommendations
Emit both old and new runner address.
Updates
Lead Judging Commences
n0kto 10 months ago
Submission Judgement Published Assigned finding tags:
finding_setUpdateWeightRunnerAddress_emit_only_new_address
Likelihood: Low, changing this address is rare. Impact: Low, incorrect event.
Prize pool breakdown
Total prize
49,600 OP
nSLOC
3,00017
OP / LOC
44,640
4,960
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.