code-423n4 / 2022-10-thegraph-findings

0 stars 0 forks source link

Set admin emit event with wrong data #236

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/upgrades/GraphProxyStorage.sol#L80-L87

Vulnerability details

Impact

emit AdminUpdated(_admin(), _newAdmin); will emit AdminUpdated with same values.

Proof of Concept

https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/upgrades/GraphProxyStorage.sol#L80-L87

Tools Used

Code analytics

Recommended Mitigation Steps

store address of admin before

trust1995 commented 1 year ago

Warden did not specify the possible impact of the wrong emit, so this would be a good finding for a QA report.

0xean commented 1 year ago

closing as low quality / over-inflated severity.