First Flight #10: One Shot

Summary

The functions OneShot::setStreetsContract and CredToken::setStreetsContract do not emint an event when the _streetsContract address is updated.

Vulnerability Details

The OneShot::setStreetsContract and CredToken::setStreetsContract functions are responsible for updating the address of the _streetsContract, which is a critical component of the contracts functionality. This function is only callable by the owner and updates the state of the contract by changing the reference to the Streets contract.

Impact

The OneShot::setStreetsContract and CredToken::setStreetsContract functions do not emit an event when the _streetsContract address is updated. Events are important for tracking changes in contract state, especially when such changes are significant and affect the contract's interactions with external components.

The absence of an event emission in the setStreetsContract function means that off-chain services, user interfaces, and other contracts will not be notified of changes to the _streetsContract address, unless they are actively polling the contract state.

Tools Used

Manual Review

Recommendations

Add an event that logs changes to the _streetsContract address and emit this event within the OneShot::setStreetsContract and CredToken::setStreetsContract functions. The event should include the old address and the new address of the _streetsContract to provide a clear record of the change.