when the indexed keyword is used for reference type variables such as dynamic arrays or strings, it will return the hash of the mentioned variables.
Thus, the event which is supposed to inform all of the applications subscribed to its emitting transaction (e.g. front-end of the DApp, or the backend listeners to that event),
would get a meaningless and obscure 32 bytes that correspond to keccak256 of an encoded dynamic array. This may cause some problems on the DApp side and even lead to data loss.
For more information about the indexed events, check here:
The problem exists inside the BaseManagedNFTStrategyUpgradeable contract. The event SetName is defined in such a way that the string variable of name is indexed.
The function setName() is intended to allow the admin to update the strategy's name for clarity or rebranding purposes.
However, with the current design, the expected parameter wouldn't be emitted properly and front-end would get a meaningless one-way hash.
Attachments
Proof of Concept (PoC) File
Consider this scenario as an example:
The function setName() is called by the admin
Inside the function setName() we expect to see the the string of "name" be emitted
But as the event topic is defined as indexed we'll get an obscure 32-byte hash and listeners will not be notified properly. Thus, the name would be lost in the DApp.
As you can see, the intended outputs wouldn't be emitted if the indexed keyword is used for the name (string), and instead, the hash of the name is returned.
Github username: @MatinR1 Twitter username: MatinRezaii1 Submission hash (on-chain): 0x36910b7540d379a44c220280d93eb7c8da5af77d853f7d3c04659deee5c65f60 Severity: low
Description: Description\
when the
indexed
keyword is used for reference type variables such as dynamic arrays or strings, it will return the hash of the mentioned variables. Thus, the event which is supposed to inform all of the applications subscribed to its emitting transaction (e.g. front-end of the DApp, or the backend listeners to that event), would get a meaningless and obscure 32 bytes that correspond to keccak256 of an encoded dynamic array. This may cause some problems on the DApp side and even lead to data loss. For more information about the indexed events, check here:(https://docs.soliditylang.org/en/v0.8.17/abi-spec.html?highlight=indexed#events)
The problem exists inside the
BaseManagedNFTStrategyUpgradeable
contract. The eventSetName
is defined in such a way that the string variable of name isindexed
. The functionsetName()
is intended to allow the admin to update the strategy's name for clarity or rebranding purposes. However, with the current design, the expected parameter wouldn't be emitted properly and front-end would get a meaningless one-way hash.Attachments
Proof of Concept (PoC) File Consider this scenario as an example:
setName()
is called by the adminsetName()
we expect to see the the string of "name" be emittedindexed
we'll get an obscure 32-byte hash and listeners will not be notified properly. Thus, the name would be lost in the DApp.For test purposes, one can run this test file:
Outputs of test:
SetName event:
SetName1 event:
As you can see, the intended outputs wouldn't be emitted if the
indexed
keyword is used for the name (string), and instead, the hash of the name is returned.Consider modifying the event
setName
inside the contract IManagedNFTStrategy :