SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[L-01] TreasureHunt::claim incorrectly logs msg.sender in Claimed event

velo

Root + Impact

Description

  • Events in Solidity are used by off-chain applications to track the state of the contract. The Claimed event is intended to track which treasure
    was found and which address received the ETH reward

  • The issue is that the event logs msg.sender (the caller of the function) as the winner, but the ETH is actually sent to the recipient address
    provided in the arguments. The contract explicitly requires that recipient != msg.sender, meaning the event always logs the wrong address as
    the beneficiary

function claim(...) external {
// ...
(bool sent, ) = recipient.call{value: REWARD}("");
require(sent, "ETH_TRANSFER_FAILED");
​
// @> Root Cause: Logging the caller instead of the fund recipient
emit Claimed(treasureHash, msg.sender);
}

Risk

Likelihood:

  • This occurs on every successful call to claim

Impact:

  • Data Inaccuracy: Off-chain indexers like The Graph or block explorers will display incorrect data, showing the "claimer" as someone who did not
    actually receive the funds

Proof of Concept

The test uses vm.expectEmit to check the parameters of the emitted event. It confirms that the contract emits the event with the attacker address
(msg.sender) even though the reward went to victim1

function test_EventLoggingBug() public {
vm.expectEmit(true, true, false, true);
// The contract incorrectly logs attacker instead of victim1
emit TreasureHunt.Claimed(FAKE_TREASURE_HASH, attacker);
​
vm.prank(attacker);
hunt.claim("", FAKE_TREASURE_HASH, payable(victim1));
}

Recommended Mitigation

Update the emit Claimed statement to use the recipient variable. This ensures the event accurately reflects the movement of funds on-chain

- emit Claimed(treasureHash, msg.sender);
+ emit Claimed(treasureHash, recipient);
Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect event parameter

The event is declared as event `Claimed(bytes32 indexed treasureHash, address indexed recipient);`, which clearly indicates that the second indexed field is meant to represent the reward recipient, but `claim()` emits `Claimed(treasureHash, msg.sender)` instead of `Claimed(treasureHash, recipient)`, even though the ETH transfer is sent to recipient and the proof itself is constructed around the public inputs (treasureHash, recipient). As a standalone finding, this is appropriately low severity because it is fundamentally an event/accounting inconsistency rather than a direct loss-of-funds issue: the core state transition and payout still follow the intended recipient, but off-chain consumers reading the event log will observe incorrect metadata about who was associated with the claim.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!