RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Wrong Event Emission

themo2

Root + Impact

Description

  • The withdrawTokens function emits TokensWithdrawn(to, token, amount) but the event is declared as TokensWithdrawn(address indexed token, address indexed to, uint256 amount). Emitting the arguments in the wrong order places the recipient address into the token topic and the token address into the to topic. Off‑chain indexers, explorers, and automated tooling that filter or decode events by the indexed token field will therefore receive incorrect data and misattribute withdrawals.

contract ReFiSwapRebateHook is BaseHook, Ownable {
event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
IERC20(token).transfer(to, amount);
//@audit-issue Emitting 'to' before 'token' in event
@> emit TokensWithdrawn(to, token , amount);
}
}
​
​
​

Risk

Likelihood:

  • Any call to withdrawTokens(...) will produce the swapped topics and thus trigger the mislabelling.

Impact:

  • dashboards, alerts, and automated workflows will see the wrong token/recipient mapping; important withdrawals may not be detected.

Proof of Concept

This demonstrates how an indexer expecting the token as the first indexed topic would be fed the recipient address instead:

contract TestReFiSwapRebateHook is Test, Deployers, ERC1155TokenReceiver{
event TokensWithdrawn(address indexed token, address indexed to, uint256 amount);
​
function test_TokensWithdrawnEventEmission() public {
// In tests
vm.expectEmit(true, true, false, true);
emit TokensWithdrawn(address(reFiToken), address(this), 0.001 ether); // expected order
​
// Call withdraw
rebateHook.withdrawTokens(address(reFiToken), address(this), 0.001 ether);
​
// The emitted topics actually contain (recipient, token, amount) so the expectation fails
}
}

Recommended Mitigation

  • Fix the event emission argument order to match the declaration. Replace:

- emit TokensWithdrawn(to, token , amount);
+ emit TokensWithdrawn(token, to, amount);
Updates

Lead Judging Commences

chaossr Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Swapped token and to parameters in TokensWithdrawn event.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!