Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

The smart contract function _burnDsc has a vulnerability that lacks event emission after a successful token transfer. The function is responsible for burning a specified amount of tokens (amountDscToBurn) on behalf of an address (onBehalfOf) by transferring them from another address (dscFrom) to the contract and subsequently burning them. However, it fails to emit an event, which can lead to transparency issues and potential difficulties in tracking token burns.

Vulnerability Details

In the _burnDsc function, after transferring the tokens using i_dsc.transferFrom(dscFrom, address(this), amountDscToBurn), there is no event emission to record the successful token burn. Events serve as a means of communicating important state changes to external systems and dApps. The absence of an event in this function can make it challenging for observers to track token burns and understand the contract's state.

Impact

The impact of this vulnerability is as follows:

• Lack of transparency: Without an emitted event, it becomes difficult for external parties to monitor token burn activities, hindering the ability to audit and understand contract behavior.

• Limited interoperability: Other smart contracts or applications that rely on event data for tracking token burns will be unable to access the required information, potentially causing compatibility issues.

Tools Used

No specific tools are used for this vulnerability. It is a code logic issue that can be identified through manual code review or code analysis.

Recommendations

To address the vulnerability and enhance contract transparency, it is recommended to add an event emission after the successful token burn in the _burnDsc function. By doing so, the contract will notify external systems about the token burn, allowing them to react to the changes and maintain accurate records. Here's an example of adding an event emission:

By implementing this recommendation, the contract will become more transparent and interoperable with other smart contracts and dApps, enabling better monitoring and tracking of token burn activities.