Submission Details
Severity:
`deposit` emits the `receiver` as the depositor
Description
The deposited event is intended to emit the address that deposited into the vault along with the amount deposited.
However, the deposit function currently emits the receiver address as the depositor instead of msg.sender.
@> event deposited (address indexed _depositor, uint256 _value);
function deposit(uint256 assets, address receiver) public override returns (uint256) {
require(receiver != address(0));
if (block.timestamp >= eventStartDate) {
revert eventStarted();
}
uint256 fee = _getParticipationFee(assets);
// charge on a percentage basis points
if (minimumAmount + fee > assets) {
revert lowFeeAndAmount();
}
uint256 stakeAsset = assets - fee;
stakedAsset[receiver] = stakeAsset;
uint256 participantShares = _convertToShares(stakeAsset);
@> IERC20(asset()).safeTransferFrom(msg.sender, participationFeeAddress, fee);
@> IERC20(asset()).safeTransferFrom(msg.sender, address(this), stakeAsset);
_mint(msg.sender, participantShares);
@> emit deposited (receiver, stakeAsset);
return participantShares;
}
Risk
Likelihood:
This occurs whenever a user calls deposit with receiver set to a different address.
Impact:
The emitted event data will be incorrect, potentially causing off-chain indexers to attribute deposits to the wrong address.
Recommended Mitigation
Emit msg.sender instead of receiver in the deposited event.
function deposit(uint256 assets, address receiver) public override returns (uint256) {
...
- emit deposited (receiver, stakeAsset);
+ emit deposited (msg.sender, stakeAsset);
return participantShares;
}
Updates
Appeal created
bube 19 days ago
Submission Judgement Published Assigned finding tags:
`deposit` function uses in the event the receiver address instead the depositor
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.