Algo Ssstablecoinsss
AI First Flight #2
Beginner FriendlyDeFi
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

CollateralDeposited Event Missing Token Address Impairs Off-Chain Monitoring

quanghoa27061998

CollateralDeposited Event Missing Token Address Impairs Off-Chain Monitoring

Description

The CollateralDeposited event only logs the user address and amount, but omits the critical token_collateral_address:

event CollateralDeposited:
user: indexed(address)
amount: indexed(uint256)

Usage at line 226:

log CollateralDeposited(msg.sender, amount_collateral)

Compare with the CollateralRedeemed event, which correctly includes the token address:

event CollateralRedeemed:
token: indexed(address)
amount_collateral: indexed(uint256)
_from: address
_to: address

Risk

Likelihood: High -- Every collateral deposit emits this incomplete event.

Impact: Low -- Off-chain monitoring systems (indexers, dashboards, analytics) cannot distinguish between WETH and WBTC deposits from events alone. This affects:

  • Protocol health dashboards that track collateral composition

  • Risk monitoring systems that need to know per-token deposit amounts

  • Incident response during security events (cannot quickly determine which token was deposited)

Proof of Concept

How the issue manifests:

  1. User A deposits 1 WETH ($2,000) -- event logs CollateralDeposited(user=A, amount=1e18)

  2. User B deposits 1e8 WBTC ($60,000) -- event logs CollateralDeposited(user=B, amount=1e8)

  3. An off-chain indexer sees both events but cannot determine which is WETH vs WBTC

Expected outcome: Monitoring tools cannot accurately track per-token collateral flows.

def test_event_missing_token_address(self, dsce, weth, some_user):
with boa.env.prank(some_user):
weth.approve(dsce.address, COLLATERAL_AMOUNT)
dsce.deposit_collateral(weth.address, COLLATERAL_AMOUNT)
​
# Event emits: CollateralDeposited(user=some_user, amount=10e18)
# Missing: which token was deposited (WETH or WBTC?)
weth_balance = dsce.get_collateral_balance_of_user(some_user, weth)
assert weth_balance == COLLATERAL_AMOUNT

Recommended Mitigation

Add token field to the CollateralDeposited event to match the pattern used by CollateralRedeemed:

event CollateralDeposited:
user: indexed(address)
token: indexed(address)
amount: indexed(uint256)

Update the log statement:

log CollateralDeposited(msg.sender, token_collateral_address, amount_collateral)
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 5 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!