First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

An event should be emitted when an NFT is minted

happyformerlawyer

Summary

The selectWinner function does not emit an event when an NFT is minted. You should emit an event when there is a state change or when something important happens (like a transfer of funds or creation of an NFT) so that you have a record of these important occurrences that you can refer back to and easily parse.

Vulnerability Details

No event is emitted when an NFT is minted:

function selectWinner() external {
require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");
require(players.length >= 4, "PuppyRaffle: Need at least 4 players");
uint256 winnerIndex =
uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;
address winner = players[winnerIndex];
uint256 totalAmountCollected = players.length * entranceFee;
uint256 prizePool = (totalAmountCollected * 80) / 100;
uint256 fee = (totalAmountCollected * 20) / 100;
totalFees = totalFees + uint64(fee);
​
uint256 tokenId = totalSupply();
​
// We use a different RNG calculate from the winnerIndex to determine rarity
uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;
if (rarity <= COMMON_RARITY) {
tokenIdToRarity[tokenId] = COMMON_RARITY;
} else if (rarity <= COMMON_RARITY + RARE_RARITY) {
tokenIdToRarity[tokenId] = RARE_RARITY;
} else {
tokenIdToRarity[tokenId] = LEGENDARY_RARITY;
}
​
delete players;
raffleStartTime = block.timestamp;
previousWinner = winner;
(bool success,) = winner.call{value: prizePool}("");
require(success, "PuppyRaffle: Failed to send prize pool to winner");
_safeMint(winner, tokenId);
}

Impact

You won't have a record that is easy to parse of when all the NFTs were minted. This is even more problematic since anyone can call selectWinner so an NFT could be minted without the contract owner's awareness.

Tools Used

Manual review

Recommendations

Add an NFTMinted event:

event NFTMinted(uint256 indexed id, address indexed winner, string memory indexed tokenRarity)

Then add the following as the last line of selectWinner:

emit NFTMinted(tokenId, previousWinner, tokenIdToRarity[tokenId]);
Updates

Lead Judging Commences

Hamiltonite Lead Judge about 2 years ago
Submission Judgement Published
Invalidated
Reason: Other
Assigned finding tags:

events are missing or not detailed enough

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!