RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Event argument order swapped in withdrawTokens (incorrect emit)

smartshielder

Root + Impact

Description

  • Normal behavior: Events should be emitted with arguments in the same order and semantic meaning as declared so off-chain indexers and tooling parse logs correctly.

Problem: The declared TokensWithdrawn(address indexed token, address indexed to, uint256 amount) event is emitted with arguments in the wrong order, swapping token and to.

// Root cause in the codebase with @> marks to highlight the relevant section
event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
​
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
@> emit TokensWithdrawn(to, token , amount);
}
​

Risk

Likelihood:

  • Withdrawal function is callable by owner and will emit this incorrect event on every withdraw call.

Any off-chain consumer (indexer, analytics, explorers) that assumes the declared order will consistently misinterpret logs.

Impact:

  • No on-chain funds or contract state are altered incorrectly by the emit itself.

Off-chain monitoring, accounting, and forensic tools will show swapped fields, potentially causing misreporting or investigations.

Proof of Concept

The event arguments are emitted in the wrong order

// On withdrawTokens(tokenAddr, recipient, 1 ether)
emit TokensWithdrawn(to, token , amount);
// Indexer will record:
// token => recipient (incorrect)
// to => token (incorrect)
​

Recommended Mitigation

Change the order of even arguments.

// Root cause in the codebase with @> marks to highlight the relevant section
event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
​
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
@> emit TokensWithdrawn(to, token , amount);
}
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
- emit TokensWithdrawn(to, token , amount);
+ emit TokensWithdrawn(token, to, amount);
}
​
Updates

Lead Judging Commences

chaossr Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Swapped token and to parameters in TokensWithdrawn event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!