Submission Details
Severity:
`ReFiSwapRebateHook::TokensWithdrawn` event has parameters out of order
Root + Impact
Event emission is incorrect, leading to off-chain functions potentially malfunctioning.
Description
When the `TokensWithdrawn` event is emitted in the `ReFiSwapRebateHook::withdrawTokens` function, it logs values in an incorrect order. The `token` should go in the first parameter position, whereas the `to` should go in the second parameter position.
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
@> emit TokensWithdrawn(to, token , amount);
}
Risk
Likelihood:
-
Reason 1 // Describe WHEN this will occur (avoid using "if" statements)
-
Reason 2
Impact:
-
Impact 1
-
Impact 2
Proof of Concept
Recommended Mitigation
emit the event with parameters in an appropriate positions.
- emit TokensWithdrawn(to, token , amount);
+ event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
Updates
Lead Judging Commences
chaossr 12 days ago
Submission Judgement Published Assigned finding tags:
Swapped token and to parameters in TokensWithdrawn event.
Rewards breakdown
nSLOC
150This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.