Submission Details
Impact:
Likelihood:
Wrong value emitted `Claimed` event
Author Revealed upon completion
Root + Impact
Description
The claim function emits
event Claimed(bytes32 indexed treasureHash, address indexed recipient);
The recipient address is supposed to be emitted yet it emits the msg sender who is not allowed to be the recipient:
emit Claimed(treasureHash, msg.sender);
Risk
Likelihood: high
It will be emitted during every call to claim
Impact:
Offchain observers will be reading the wrong value thinking it's the recipient
Proof of Concept
Nil
Recommended Mitigation
- emit Claimed(treasureHash, msg.sender);
+ emit Claimed(treasureHash, recipient);
Rewards breakdown
nSLOC
220This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.