First Flight #2: Puppy Raffle

Summary

Events not emitting old values for events that emit changes to state variables

Vulnerability Details

Events "event FeeAddressChanged(address newFeeAddress);" which is a critical parameter update for fee address when changed does not emit the old value but only the newFeeAddress

Impact

Events must be as informative as possible to benefit offchain tooling, front ends, monitoring, reporting and even security tools which rely on this. e.g if old value is same as new value and that was not intention, action can be immediately taken if picked up real time thanks to event logs

Tools Used

Manual Analysis

Recommendations

Ensure events especially changing state parameters or critical update emit the old value and the new value to show change e.g