L-32·

`Indexed` keyword in events causes struct data loss

Not reportedoptionsleverageblack-scholes

TL;DR

When the indexed keyword is used for reference type variables such as dynamic arrays or structs, it will return the hash of the mentioned variables.

Severity

LOW

Method

MManual review

CAT.

When the indexed keyword is used for reference type variables such as dynamic arrays or structs, it will return the hash of the mentioned variables. Thus, the event, which is supposed to inform all of the applications subscribed to its emitting transaction (e.g. front-end of the DApp, or the backend listeners to that event), would get a meaningless and obscure 32 bytes that correspond to keccak256 of an encoded struct/array. This may cause some problems on the DApp side and even lead to data loss.

The problem exists inside the IStrategy contract. The event Acquired is defined in such a way that the data field, which is a struct instance, is indexed. With doing so, the expected parameter wouldn't be emitted properly and the front-end would get meaningless one-way hashes.

We can see the effect of omitting the indexed keyword for the event by defining another event named Acquired1:

solidity

    event Acquired(
        uint256 indexed id,
        StrategyData indexed data,
        uint256 sizeUSD
    );

    event Acquired1(
        uint256 indexed id,
        StrategyData data,
        uint256 sizeUSD
    );

    struct StrategyData {
        uint128 amount; // 18 decimals
        uint128 strike; // 18 decimals
    }

    function eventEmitter() public {
        StrategyData memory st1 = StrategyData({amount: 42e6, strike: 5});
        emit Acquired(1, st1, 100);
        emit Acquired1(1, st1, 100);
    }

The result would be:

event Acquired:

code

	{
		"from": "0x5Ea69b5B2f499Ad9f1127E77d1179cCb471b5e19",
		"topic": "0x8139f37233b28b6f84e65bdca1901a93aaf3c54ef5572840702eb6d3a389ada6",
		"event": "Acquired",
		"args": {
			"0": "1",
			"1": {
				"_isIndexed": true,
				"hash": "0xf4941371d1251c4c97c60a36bd52b6033835913929454e8601110c6f3faecf76"
			},
			"2": "100"
		}

event Acquired1:

code

	{
		"from": "0x5Ea69b5B2f499Ad9f1127E77d1179cCb471b5e19",
		"topic": "0x303c7cf269a5457a46482b73a49633deaacadb51f603cb724dceebbcb647cea1",
		"event": "Acquired1",
		"args": {
			"0": "1",
			"1": [
				"42000000",
				"5"
			],
			"2": "100",
			"id": "1",
			"data": [
				"42000000",
				"5"
			],
			"sizeUSD": "100"
		}
	}

Recommendation:

diff

    event Acquired(
        uint256 indexed id,
-       StrategyData indexed data,
+       StrategyData data,
        uint256 sizeUSD,
        uint256 premium,
        uint256 period,
        uint256 indexed iv
    );

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.