Beanstalk Part 2

Summary

Throughout the FertilizerFacet.sol file, there are several cases where sensitive actions are performed, but there are no events being emitted, or the existing emitted events miss important parameters. The only mentioned event in the code, SetFertilizer, was still left out unused.

Vulnerability Details

• Missing Events: Several critical functions, such as mintFertilizer , claimFertilized and beginBarnRaiseMigration, perform actions that are significant for the contract's functionality, but they do not emit any events to notify external observers or users about these actions.

• Unused Event: The SetFertilizer event is defined in the contract but is not emitted anywhere in the code. This event appears to be intended to notify external observers about changes to fertilizer settings, but its lack of usage renders it ineffective.

Impact

The lack of emitted events or the omission of important parameters in emitted events reduces transparency and observability of the contract's behavior. This can lead to difficulties in monitoring contract activity, debugging issues, and understanding user interactions. Additionally, the absence of event notifications may result in users being unaware of important contract events or actions taken on their behalf.

Tools Used

Manual

Recommendations

• Event Emission: Ensure that critical actions within the contract, such as minting fertilizers (mintFertilizer), claiming fertilized sprouts (claimFertilized), and beginning barn raise migrations (beginBarnRaiseMigration), emit events to provide transparency and notification to external observers.

• Include Relevant Parameters: When emitting events, make sure to include all relevant parameters that provide context or additional information about the event. This ensures that observers have sufficient information to understand the event's significance and impact.

• Utilize Unused Event: If the SetFertilizer event serves a purpose in the contract, ensure that it is emitted at appropriate times, such as when fertilizer settings are updated or modified. This enhances transparency and provides visibility into changes affecting fertilizer functionality. If the event is no longer needed, consider removing it to avoid confusion.