GalloDaSballo / Apollon-Review

Notes for the Apollon Solo Security Review
0 stars 0 forks source link

`SwapPair` events use `msg.sender` but they should use the user taking on debt #28

Open GalloDaSballo opened 3 months ago

GalloDaSballo commented 3 months ago

Impact

Events in SwapPair are logging msg.sender which will always be swapOperations

https://github.com/blkswnStudio/ap/blob/8fab2b32b4f55efd92819bd1d0da9bed4b339e87/packages/contracts/contracts/SwapPair.sol#L125-L126

    emit Mint(msg.sender, amount0, amount1); /// @audit QA: Mint should change to `to`

https://github.com/blkswnStudio/ap/blob/8fab2b32b4f55efd92819bd1d0da9bed4b339e87/packages/contracts/contracts/SwapPair.sol#L169

emit Burn(msg.sender, amount0, amount1, to); /// @audit QA: Mint should change to `to` or to the cdp Owner

Mitigation

Either change the log to to (the recipient), or add a initiator parameter and log that one

Alternatively, move the events in the SwapOperations

sambP commented 2 months ago
Screenshot 2024-08-31 at 1 43 03 PM Screenshot 2024-08-31 at 1 43 12 PM