RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Sender Logged in Events During Native ETH Swaps

ashutoshcshah

Description

In _beforeSwap, events use:

emit ReFiBought(sender, swapAmount);
​

However, in Uniswap V4, sender is not the user.

For swaps involving native ETH (or via router):

  • msg.sender = router

  • sender (param) = router

  • actual user = tx.origin or msg.sender of router

Result:
Events show the router as the entity that bought/sold ReFi, not the real user.

This breaks:

  • analytics

  • aggregators

  • reward/points systems

  • anti-bot/trading rules

  • user-facing dashboards

Example:

User swaps through SwapRouter, but every event shows:

sender = 0xUniswapV4Router
​

This is incorrect and hides real trading behavior.

Impact

  • Completely incorrect user trading data

  • Misapplied rebates or rewards

  • Trading volume appears massively skewed toward router

  • Impossible to track real traders

  • Attackers can exploit router abstraction to:

    • bypass anti-whale limits

    • avoid volume tracking

    • cheat volume-based rewards

This is a serious problem for any protocol attaching economics or analytics to events.

Proof of Concept

function test_EventSenderIsRouter() public {
// User initiates swap through swap router
address user = makeAddr("user");
vm.startPrank(user);
​
// Expect event, but sender will be router, not user (bug)
vm.expectEmit(true, true, true, true);
emit ReFiSwapRebateHook.ReFiBought(address(router), amount);
​
router.swap(...); // executed by user
}
​

Result:

  • sender in event = router

  • Correct should be = user

Recommended Mitigation

Use the correct user address.
When using a router-based pattern:

Replace:

emit ReFiBought(sender, swapAmount);
​

With:

emit ReFiBought(msg.sender, swapAmount);
​
Updates

Lead Judging Commences

chaossr Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Router address emitted instead of user in ReFiBought/ReFiSold events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!