RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect event parameter order in TokensWithdrawn Event

nutledger

Root + Impact

Description

  • The TokensWithdrawn event is designed to log token withdrawal operations, emitting the token address, recipient address, and amount. Off-chain systems like block explorers, analytics dashboards, and monitoring tools rely on correct event indexing to track protocol activity.

  • The event is emitted with swapped parameters: to and token are passed in reverse order compared to the event declaration. This causes indexed event data to be incorrect — the token address is logged as the recipient and vice versa.

@> event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
@> emit TokensWithdrawn(to, token, amount); // BUG: parameters swapped
}

Risk

Likelihood:

  • Every token withdrawal triggers this incorrectly ordered event

  • The bug is deterministic and occurs 100% of the time

Impact:

  • Off-chain indexers will record incorrect data

  • Block explorers will display the recipient address as the token and vice versa

  • Monitoring and alerting systems may fail to detect withdrawals of specific tokens

  • Audit trails and accounting become unreliable

  • Incident response teams may be misled during security investigations

Proof of Concept

The issue can be verified by examining event logs after a withdrawal:

function test_POC_IncorrectEventParameterOrder() public {
// Send tokens to hook
reFiToken.transfer(address(rebateHook), 1 ether);
address recipient = address(0xBEEF);
uint256 withdrawAmount = 0.5 ether;
// Expect event with CORRECT order (token, to, amount)
vm.expectEmit(true, true, false, true);
emit ReFiSwapRebateHook.TokensWithdrawn(
address(reFiToken), // token (first indexed param)
recipient, // to (second indexed param)
withdrawAmount
);
// This will FAIL because actual emission is (to, token, amount)
rebateHook.withdrawTokens(address(reFiToken), recipient, withdrawAmount);
}

When examining raw logs:

  • Expected: topic1 = reFiToken address, topic2 = recipient address

  • Actual: topic1 = recipient address, topic2 = reFiToken address

Recommended Mitigation

Swap the parameters in the emit statement to match the event declaration order:

function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
- emit TokensWithdrawn(to, token, amount);
+ emit TokensWithdrawn(token, to, amount);
}
Updates

Lead Judging Commences

chaossr Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Swapped token and to parameters in TokensWithdrawn event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!