SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: high

[L-01] TreasureHunt::claim incorrectly logs msg.sender in Claimed event

Author Revealed upon completion

Root + Impact

Description

  • Events in Solidity are used by off-chain applications to track the state of the contract. The Claimed event is intended to track which treasure
    was found and which address received the ETH reward

  • The issue is that the event logs msg.sender (the caller of the function) as the winner, but the ETH is actually sent to the recipient address
    provided in the arguments. The contract explicitly requires that recipient != msg.sender, meaning the event always logs the wrong address as
    the beneficiary

function claim(...) external {
// ...
(bool sent, ) = recipient.call{value: REWARD}("");
require(sent, "ETH_TRANSFER_FAILED");
​
// @> Root Cause: Logging the caller instead of the fund recipient
emit Claimed(treasureHash, msg.sender);
}

Risk

Likelihood:

  • This occurs on every successful call to claim

Impact:

  • Data Inaccuracy: Off-chain indexers like The Graph or block explorers will display incorrect data, showing the "claimer" as someone who did not
    actually receive the funds

Proof of Concept

The test uses vm.expectEmit to check the parameters of the emitted event. It confirms that the contract emits the event with the attacker address
(msg.sender) even though the reward went to victim1

function test_EventLoggingBug() public {
vm.expectEmit(true, true, false, true);
// The contract incorrectly logs attacker instead of victim1
emit TreasureHunt.Claimed(FAKE_TREASURE_HASH, attacker);
​
vm.prank(attacker);
hunt.claim("", FAKE_TREASURE_HASH, payable(victim1));
}

Recommended Mitigation

Update the emit Claimed statement to use the recipient variable. This ensures the event accurately reflects the movement of funds on-chain

- emit Claimed(treasureHash, msg.sender);
+ emit Claimed(treasureHash, recipient);

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!