[NAZ-M4] Incorrect Address Emitted

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/SemiFungibleVault.sol#L37

Vulnerability details

Impact

The Deposit() event in deposit() is emitted when an asset is deposited from msg.sender and shares are sent to a receiver. Its second parameter indicates the address to which the asset is owned by. However, the Deposit() event emitted uses receiver(owner of shares) instead of the msg.sender's(owner of assets) address . This may mislead protocol user interfaces and off-chain monitoring systems to misinterpret the amounts of assets being redeemed or minted to cause confusion, flagging of alerts or DoS.

Tools Used

Manual Review

Recommended Mitigation Steps

Change emit Deposit(msg.sender, receiver, id, assets, shares) To emit Deposit(msg.sender, msg.sender, id, assets, shares) or change the wording in the natspec so that it reflects what is actually happening.

[HickupHH3]

wrong param emitted in event would be low-risk. downgrading. part of #474