# 51989 sc low event restrictionscreated always emits msg sender as owner 

**Submitted on Aug 7th 2025 at 04:35:12 UTC by @Killua for** [**Attackathon | Plume Network**](https://immunefi.com/audit-competition/plume-network-attackathon)

* **Report ID:** #51989
* **Report Type:** Smart Contract
* **Report severity:** Low
* **Target:** <https://github.com/immunefi-team/attackathon-plume-network/blob/main/arc/src/restrictions/RestrictionsFactory.sol>

## Description

The `createWhitelistRestrictions()` function in the `RestrictionsFactory` contract always emits `msg.sender` as the owner in the `RestrictionsCreated` event.

When an `admin` parameter is provided, that admin becomes the actual controller of the restrictions module, but the event incorrectly logs `msg.sender` as the owner. The actual owner should be: `admin != address(0) ? admin : msg.sender`

## Vulnerability Details

The event emission currently uses:

```
emit RestrictionsCreated(proxy, msg.sender, address(implementation), "Whitelist");
```

This will always log `msg.sender` as the owner even when a different `admin` was supplied and initialized as the controller.

## Impact Details

* Event logs will not accurately reflect the actual control structure of deployed modules.
* Possible off-chain monitoring and tooling may misrepresent ownership/control of the deployed module.

## Proof of Concept

Relevant snippet showing initialization and event emit:

```solidity
function createWhitelistRestrictions(address admin) external returns (address) {
    // ... existing code ...
     
    bytes memory initData =
        abi.encodeWithSelector(WhitelistRestrictions.initialize.selector, admin != address(0) ? admin : msg.sender);
    
    address proxy = _deployProxy(address(implementation), initData);
    
    // @audit Emits msg.sender always. 
    emit RestrictionsCreated(proxy, msg.sender, address(implementation), "Whitelist");

    //..//..
}
```

Suggested change (conceptual) — capture the actual admin and use it in the event emission:

```solidity
address actualAdmin = admin != address(0) ? admin : msg.sender;
emit RestrictionsCreated(proxy, actualAdmin, address(implementation), "Whitelist");
```

## References

Original event usage:

```
emit RestrictionsCreated(proxy, msg.sender, address(implementation), "Whitelist");
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://reports.immunefi.com/plume-or-attackathon/51989-sc-low-event-restrictionscreated-always-emits-msg-sender-as-owner.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.