Skip to content

FLOW-12: Escrow Balance Events Missing on COA Processing #27

@liobrasil

Description

@liobrasil

Severity: Informational

Files Affected

  • solidity/src/FlowYieldVaultsRequests.sol

Description

In FlowYieldVaultsRequests.sol, escrow/refund balances are tracked in pendingUserBalances and are sometimes surfaced via the BalanceUpdated event, such as when _createRequest() credits escrow for CREATE_YIELDVAULT/DEPOSIT_TO_YIELDVAULT, and when cancelRequest(), dropRequests(), and claimRefund() adjust balances.

However:

  • startProcessing() deducts pendingUserBalances[request.user][request.tokenAddress] for CREATE/DEPOSIT without emitting BalanceUpdated
  • completeProcessing() can credit pendingUserBalances on failed CREATE/DEPOSIT refunds without emitting BalanceUpdated

As a result, event-driven indexers and UIs may not observe escrow/refund balance changes that occur during COA-driven lifecycle transitions unless they continuously read storage or implement custom inference logic.

Recommendation

Emit BalanceUpdated(request.user, request.tokenAddress, pendingUserBalances[request.user][request.tokenAddress]) after the escrow deduction in startProcessing() and after the refund credit in completeProcessing() for failed CREATE/DEPOSIT requests.


Parent Issue: #15

Metadata

Metadata

Assignees

Labels

InformationalInformational security finding⎈ QuantStampQuantStamp audit finding

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions