# Incorrect `RefundClaim` event due to deleting `idoConfig.accountPositions[msg.sender]` Low/Info · Three Sigma · IDO launchpad · 7th August, 2024 Finding L-1 of the Blast IDO Pools security review. - Protocol: https://docs.blastup.io/blastup-docs - Report: /reports/blast-ido-pools - Source: https://cdn.sanity.io/files/qoqld077/production/d2a7ca81740e715b604122c12dafbce599e43f2f.pdf --- ### Description The refund event is emitted as `emit RefundClaim(idoRoundId, msg.sender, pos.amount, pos.fyAmount);`. `pos` is defined as `IDOStructs.Position storage pos = idoConfig.accountPositions[msg.sender];`. Before emitting the event, the mapping is deleted `delete idoConfig.accountPositions[msg.sender];`. Thus, when the event is emitted, `pos.amount` and `pos.fyAmount` have been deleted. ### Recommendation Emit the event before deleting the mapping. --- Related findings: - [`Borrowing::redeemYields` debits `ABOND` from `msg.sender` but redeems to `user` using `ABOND.State` data from `user`](https://0xsimao.com/findings/autonomint-redeem-yields-debits-redeems): Autonomint - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO - [Depositing to another receiver othan than `msg.sender` will lead to stuck funds by increasing `avgStart` without claiming](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-othan-stuck-increasing-avg): Exactly Protocol Update - Staking Contract - [_msgSender() is mixed with msg.sender](https://0xsimao.com/findings/mitosis-msg-sender-mixed): Mitosis