Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

RAACMinter Strange Event Emission

funkornaut

Summary

In RAACMinter.sol, address parameters are being converted to uint256 when emitting events, which could cause issues with off-chain integrations expecting properly formatted addresses.

Vulnerability Details

The contract converts addresses to uint256 when emitting ParameterUpdated events:

function setStabilityPool(address _stabilityPool) external onlyRole(UPDATER_ROLE) {
if (_stabilityPool == address(0)) revert ZeroAddress();
stabilityPool = IStabilityPool(_stabilityPool);
emit ParameterUpdated("stabilityPool", uint256(uint160(_stabilityPool))); // @audit address converted to uint256
}
​
function setLendingPool(address _lendingPool) external onlyRole(UPDATER_ROLE) {
if (_lendingPool == address(0)) revert ZeroAddress();
lendingPool = ILendingPool(_lendingPool);
emit ParameterUpdated("lendingPool", uint256(uint160(_lendingPool))); // @audit address converted to uint256
}
​
function setFeeCollector(address _feeCollector) external onlyRole(UPDATER_ROLE) {
if (_feeCollector == address(0)) revert FeeCollectorCannotBeZeroAddress();
raacToken.setFeeCollector(_feeCollector);
emit ParameterUpdated("feeCollector", uint256(uint160(_feeCollector))); // @audit address converted to uint256
}

This conversion:

  1. Removes the '0x' prefix from addresses

  2. Changes the format of the data

  3. Makes it harder for off-chain services to identify these values as addresses

Impact

  • Off-chain integrations expecting properly formatted addresses in events will need additional logic to handle these numeric values

  • Reduced readability and maintainability of event logs

  • Potential for confusion or errors when processing event data

Tools Used

Manual Review

Recommendations

  1. Emit addresses without conversion:

function setStabilityPool(address _stabilityPool) external onlyRole(UPDATER_ROLE) {
if (_stabilityPool == address(0)) revert ZeroAddress();
stabilityPool = IStabilityPool(_stabilityPool);
emit ParameterUpdated("stabilityPool", _stabilityPool);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.