Root + Impact

Root Cause: The CollateralDeposited event only includes the user address and amount, omitting which collateral token was deposited.

Impact: Off-chain indexers and monitoring systems cannot distinguish between WETH and WBTC deposits from event logs alone. This complicates analytics, portfolio tracking, and forensic analysis after incidents.

Description

Normal Behavior: Events should contain all relevant information for off-chain indexing and monitoring.

Issue: The CollateralDeposited event doesn't include which token was deposited, making it impossible to distinguish between WETH and WBTC deposits from event logs alone.

Risk

Likelihood:LOW

• Reason 1 : Every collateral deposit emits this incomplete event

• Reason 2 : All off-chain systems processing deposits are affected

Impact:

• Impact 1 : Reduced observability and monitoring capabilities

• Impact 2 : Incomplete audit trails for security analysis

Proof of Concept

A user deposits 1 ETH followed by 0.5 WBTC. The events emitted are CollateralDeposited(user, 1e18) and CollateralDeposited(user, 5e7). From these events alone, an indexer cannot determine which deposit was ETH and which was WBTC without querying additional on-chain state.

Recommended Mitigation

Add the token address as an indexed parameter to the event. Unindex the amount field since Ethereum allows only 3 indexed parameters, and the token address is more valuable for filtering queries.