RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

TokensWithdrawn Event Parameters Are Emitted in Wrong Order

rf_

Root + Impact

Description

The TokensWithdrawn event is meant to accurately log withdrawals by emitting the parameters in the order defined in the event signature.

However, the contract emits the parameters in the wrong order, swapping token and to.
This results in off-chain indexers, analytics, and monitoring systems receiving incorrect withdrawal data.

event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
​
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
​
@> emit TokensWithdrawn(to, token, amount); // WRONG ORDER
}

Risk

Likelihood:

  • Triggered every time the owner withdraws tokens.

  • Off-chain systems will always process incorrect event data.

  • Any subgraph or monitoring tool relying on this event will misinterpret withdrawals.

Impact:

  • Wallets/addresses appear reversed in logs.

  • Token accounting becomes unreliable or misleading.

  • Protocol transparency is degraded.

  • Auditors and integrators may misread treasury movements.

Proof of Concept

// Owner calls:
withdrawTokens(USDC, treasury, 1000);
​
// Event emitted:
TokensWithdrawn(
to = treasury,
token = USDC,
amount = 1000
);
​
// Off-chain interpretation:
token = treasury (incorrect)
to = USDC (incorrect)
amount = 1000

This demonstrates that log consumers will treat the receiver as the token address and the token address as the receiver.

Recommended Mitigation

Reorder the event parameters to match the event declaration.

- emit TokensWithdrawn(to, token, amount);
+ emit TokensWithdrawn(token, to, amount);

This ensures event data aligns with expectations and off-chain systems process accurate information.

Updates

Lead Judging Commences

chaossr Lead Judge 8 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Swapped token and to parameters in TokensWithdrawn event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!