hats-finance / Intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a

The smart contracts of the Intuition protocol v1.
https://intuition.systems
Other
0 stars 1 forks source link

Incorrect Parameter in Redeemed Event Emission #71

Open hats-bug-reporter[bot] opened 3 days ago

hats-bug-reporter[bot] commented 3 days ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0xfe48c86ee5fde1eaae0770dab56021baee6c579c2aa94c61a309134d82982c86 Severity: low

Description: Description\ In the _redeem function of the EthMultiVault contract, there's a minor discrepancy between the declared event signature and the actual event emission. The Redeemed event is designed to include the vault's total balance, but the implementation incorrectly emits the owner's balance instead. This inconsistency could lead to confusion for off-chain systems monitoring these events and potentially cause issues with data integrity in external applications relying on this information.

Attack Scenario\ While this is not directly exploitable, it could lead to the following issues:

  1. Off-chain systems or dApps relying on the Redeemed event for tracking the vault's total balance will receive incorrect data.
  2. This could result in misrepresentation of the vault's state in user interfaces or analytics platforms.
  3. In a worst-case scenario, it might lead to incorrect decision-making by users or automated systems if they assume the emitted value represents the total vault balance.

Attachments

  1. Proof of Concept (PoC) File https://github.com/hats-finance/Intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a/blob/b2e422ff0c3e3729e58d2699fdf2ef8699fbd172/src/EthMultiVault.sol#L987

  2. Revised Code File (Optional)

    function _redeem(uint256 id, address owner, uint256 shares) internal returns (uint256, uint256) {
    // ... (previous code remains the same)
    
    _burn(owner, id, shares);
    
    // Corrected: Use totalShares instead of owner's balance
    emit Redeemed(msg.sender, owner, vaults[id].totalShares, assetsForReceiver, shares, exitFee, id);
    
    return (assetsForReceiver, protocolFee);
    }