First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing events

ciara

L1BossBridge::withdrawToL1, L1BossBridge::sendToL1, and L1BossBridge::setSigner do not emit events. Therefore, changes to the signers and withdrawals are not able to be viewed off-chain.

Impact

When the state is initialized or modified, an event needs to be emitted.
Any state that is initialized or modified without an event being emitted is not visible off-chain. This means that any off-chain service is not able to view changes. For example, the key operators might look at the events to see how many signers had been set or withdrawals that have taken place.

This is a low-impact finding with a high likelihood since the contract is upgradeable, so is therefore being graded as a low-severity vulnerability.

Recommended mitigation

Emit events for state-changing transactions:

+ event TokensWithdrawn(address to, uint256 amount);
​
function withdrawTokensToL1(address to, uint256 amount, uint8 v, bytes32 r, bytes32 s) external {
sendToL1(
v,
r,
s,
abi.encode(
address(token),
0, // value
abi.encodeCall(IERC20.transferFrom, (address(vault), to, amount))
)
);
+ emit TokensWithdrawn(to, amount);
}
+ event SentToL1(address target, uint256 value, bytes data);
​
function sendToL1(uint8 v, bytes32 r, bytes32 s, bytes memory message) public nonReentrant whenNotPaused {
address signer = ECDSA.recover(MessageHashUtils.toEthSignedMessageHash(keccak256(message)), v, r, s);
​
if (!signers[signer]) {
revert L1BossBridge__Unauthorized();
}
​
(address target, uint256 value, bytes memory data) = abi.decode(message, (address, uint256, bytes));
​
(bool success,) = target.call{ value: value }(data);
if (!success) {
revert L1BossBridge__CallFailed();
}
+ emit SentToL1(target, value, data);
}
+ event SignerSet(address account, bool enabled);
​
function setSigner(address account, bool enabled) external onlyOwner {
signers[account] = enabled;
+ emit SigerSet(account, enabled);
}
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

missing events emission

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.