Algo Ssstablecoinsss
AI First Flight #2
Beginner FriendlyDeFi
EXP
View results
Submission Details
Impact: low
Likelihood: high
Invalid

CollateralDeposited event omits the collateral token, making on-chain deposit accounting unattributable by asset

tray198

Description

dsc_engine.vy emits a CollateralDeposited event on every deposit, but the event only carries the depositor and the amount — it does not include which collateral token was deposited:

event CollateralDeposited:
user: indexed(address)
@> amount: indexed(uint256) # no `token` field — cannot tell WETH from WBTC

The deposit path logs it without the token:

self.user_to_token_address_to_amount_deposited[msg.sender][
token_collateral_address
] += amount_collateral
@> log CollateralDeposited(msg.sender, amount_collateral) # token_collateral_address dropped

By contrast the sibling event CollateralRedeemed (same file) does include token. Because the engine supports two collateral tokens (WETH and WBTC), and is explicitly designed to be forked with an arbitrary basket of assets, an off-chain indexer, accounting system, or monitoring bot consuming CollateralDeposited cannot attribute a deposit to a specific collateral asset. This is an information-completeness defect, not a fund-loss bug: on-chain state (user_to_token_address_to_amount_deposited) remains correct, but any consumer that relies on events to reconstruct per-asset deposit balances is broken.

Risk

Likelihood: High

  • The malformed event is emitted on every single call to deposit_collateral / deposit_collateral_and_mint_dsc, for both supported collateral tokens.

Impact: Low

  • No funds are lost or stolen; contract accounting is unaffected.

  • Off-chain systems (indexers, dashboards, risk/liquidation monitors, accounting) that rebuild per-collateral deposit balances from logs produce incorrect results, and deposits of different tokens are indistinguishable in the event stream. This can cause operational errors and mis-reporting.

Proof of Concept

Add to tests/unit/test_dsc_engine.py (uses the existing dsce, some_user, weth, wbtc fixtures). The same user deposits two different collateral tokens; both emitted CollateralDeposited events are indistinguishable because neither exposes a token field.

import boa
from eth_utils import to_wei
​
DEPOSIT = to_wei(1, "ether")
​
def test_collateral_deposited_event_cannot_identify_token(dsce, some_user, weth, wbtc):
with boa.env.prank(some_user):
weth.approve(dsce.address, DEPOSIT)
dsce.deposit_collateral(weth.address, DEPOSIT)
wbtc.approve(dsce.address, DEPOSIT)
dsce.deposit_collateral(wbtc.address, DEPOSIT)
​
deposits = [
lg for lg in dsce.get_logs()
if type(lg).__name__ == "CollateralDeposited"
]
assert len(deposits) == 2
​
# Two deposits of DIFFERENT collateral tokens...
for lg in deposits:
# ...but the event has no `token` field to tell them apart:
assert not hasattr(lg, "token")
assert hasattr(lg, "user")
assert hasattr(lg, "amount")
​
# Identical, indistinguishable events despite different collateral:
assert deposits[0].args == deposits[1].args

Running mox test (or pytest) passes, confirming the deposit event stream cannot distinguish WETH deposits from WBTC deposits.

Recommended Mitigation

Add the collateral token to the event and log it, mirroring CollateralRedeemed:

event CollateralDeposited:
user: indexed(address)
+ token: indexed(address)
amount: indexed(uint256)
self.user_to_token_address_to_amount_deposited[msg.sender][
token_collateral_address
] += amount_collateral
- log CollateralDeposited(msg.sender, amount_collateral)
+ log CollateralDeposited(msg.sender, token_collateral_address, amount_collateral)

After this change, each deposit event carries the collateral token, so off-chain consumers can attribute deposits per asset, consistent with CollateralRedeemed.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!