Events arent being logged and parsed properly according to the docs.

[howlbot-integration[bot]]

Lines of code

https://github.com/code-423n4/2024-06-thorchain/blob/e3fd3c75ff994dce50d6eb66eb290d467bd494f5/chain/ethereum/contracts/THORChain_Router.sol#L209 https://github.com/code-423n4/2024-06-thorchain/blob/e3fd3c75ff994dce50d6eb66eb290d467bd494f5/chain/ethereum/contracts/THORChain_Router.sol#L247 https://github.com/code-423n4/2024-06-thorchain/blob/e3fd3c75ff994dce50d6eb66eb290d467bd494f5/chain/ethereum/contracts/THORChain_Router.sol#L466 https://github.com/code-423n4/2024-06-thorchain/blob/e3fd3c75ff994dce50d6eb66eb290d467bd494f5/chain/ethereum/contracts/THORChain_Router.sol#L176

Vulnerability details

Impact

There are 2 issues

• As there are no events of any V5 based functions that are being parsed in smartcontract_log_parser.go due to which all of the v5 function based txn will be considered invalid.
• This issue also lies in the _routerDeposit which also doesn't emit any event due to which transferAllowance txn would be considered valid if the router is different.

  In the discord server it was mentioned that any V5 functionality that isn't in smartcontract_log_parser should be considered out of scope, even in this case the second impact stands true and it seems to be huge to consider this finding a medium severity one.

  Proof of Concept

  In the readme one of the core invariants is: Only valid events emitted from the Router contract itself should result in the txInItem parameter being populated in the GetTxInItem function of the smartcontract_log_parser

The current implementation seems to completely break this invariant not only for V5 functions but also for _routerDeposit

Tools Used

Manual review

Recommended Mitigation Steps

• Make sure to emit an event in _routerDeposit
• Update the smartcontract_log_parser.go according to the event of V5 functions

Assessed type

Other

[c4-judge]

trust1995 changed the severity to 3 (High Risk)

[c4-judge]

trust1995 marked the issue as satisfactory

[c4-judge]

trust1995 marked the issue as unsatisfactory: Out of scope