RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Parameter Order in TokensWithdrawn Event

minos

Incorrect Parameter Order in TokensWithdrawn Event

Description

  • During normal token withdrawal operations, the hook contract should correctly record the token withdrawal event for on-chain monitoring and audit tracking.

  • The parameter order in the event triggered within the withdrawTokens function does not match the event definition, resulting in incorrect recording of critical information in the event log.

function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
@> emit TokensWithdrawn(to, token , amount); // ❌ Error: Parameter order does not match the event definition
}
​
@> event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
// Correct definition: token, to, amount
// Incorrect invocation: to, token, amount

Risk

Likelihood:

  • The incorrect event recording is triggered every time the owner calls the token withdrawal function.

  • All event logs for token withdrawal operations will contain incorrect parameter mappings.

  • This function may be activated for use in future protocol upgrades.

Impact:

  • Event Parsing Confusion: Monitoring tools and blockchain explorers will incorrectly display the recipient address as the token address, and vice versa.

  • Indexed Search Failure: Due to incorrect assignment of indexed parameters, event filtering functions based on token addresses or recipient addresses will not work properly.

  • Data Statistics Errors: Data analysis tools based on event logs will produce incorrect reports on token flow statistics.

Proof of Concept

  • N/A

Recommended Mitigation

function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
- emit TokensWithdrawn(to, token , amount);
+ emit TokensWithdrawn(token, to, amount);
}
Updates

Lead Judging Commences

chaossr Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Swapped token and to parameters in TokensWithdrawn event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!