Algo Ssstablecoinsss
AI First Flight #2
Beginner FriendlyDeFi
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

CollateralDeposited omits the collateral token address, so deposits can't be attributed to WETH vs WBTC off-chain

hopeh

Description

The CollateralDeposited event does not record which collateral token was deposited:

event CollateralDeposited:
user: indexed(address)
amount: indexed(uint256)
​
@internal
def _deposit_collateral(token_collateral_address: address, amount_collateral: uint256):
...
self.user_to_token_address_to_amount_deposited[msg.sender][token_collateral_address] += amount_collateral
log CollateralDeposited(msg.sender, amount_collateral) # token_collateral_address is NOT logged
...

The engine supports multiple collateral tokens (WETH and WBTC), and internally keys deposits by [user][token]. But the emitted event carries only user and amount — not token_collateral_address. An off-chain indexer, accounting system, or liquidation bot consuming CollateralDeposited cannot tell whether a given deposit was WETH or WBTC, and therefore cannot reconstruct per-token balances from events alone.

This is inconsistent with the sibling event, which does include the token:

event CollateralRedeemed:
token: indexed(address)
amount_collateral: indexed(uint256)
_from: address
_to: address

So redemptions are attributable to a token but deposits are not, making it impossible to reconcile the two sides purely from logs. (Separately, marking amount as indexed while omitting the token is a poor choice — indexing the token would be far more useful for filtering.)

Risk

Impact: Low. No funds are at risk and on-chain accounting (user_to_token_address_to_amount_deposited) remains correct; the defect is in observability. Off-chain consumers that rely on events for per-token deposit tracking, monitoring, or liquidation targeting will be unable to attribute deposits to a collateral asset.

Likelihood: High. Every deposit emits the incomplete event.

Proof of Concept

alice deposits 1e18 WETH -> log CollateralDeposited(alice, 1e18)
alice deposits 5e7 WBTC -> log CollateralDeposited(alice, 5e7)
​
# An indexer sees two deposits by alice but cannot determine which token each was,
# nor reconcile against CollateralRedeemed(token, amount, ...) which DOES name the token.

Recommended Mitigation

Include the collateral token in the event (and prefer indexing the token over the amount), mirroring CollateralRedeemed:

event CollateralDeposited:
user: indexed(address)
token: indexed(address)
amount: uint256
​
# ...
log CollateralDeposited(msg.sender, token_collateral_address, amount_collateral)
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!