Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of emit Events

devvmichael

Summary

The contract does not emit events for critical state changes, hindering transparency and off-chain monitoring.

Vulnerability Details (POC)

Examples of Missing Events:

  • buyBox() Function:

    function buyBox() public payable {
    require(msg.value == boxPrice, "Incorrect ETH sent");
    boxesOwned[msg.sender] += 1;
    // Missing event emission
    }
    ​
    ​
    ​
    ​
    ​
    ​
    ​

  • openBox() Function:

function openBox() public {
// ... reward logic
// Missing event emission
}

  • User Experience: Users are unable to track their transactions and the outcomes of their actions via event logs.

  • Developers: Cannot build responsive front-ends or integrate with off-chain services without events.

While the test code verifies function behaviors, it does not check for event emissions due to their absence.

Impact

  • Reduced Transparency: Users cannot verify actions occurred as expected.

  • Integration Challenges: Difficulties in building applications that rely on event logs.

  • Auditing Difficulties: Harder to audit and monitor contract activities.

Tools Used

  • Manual Code Inspection: Noted the absence of emit statements and no events were declared.

Recommendations

Add event definitions and emit them in relevant functions:

// Event Definitions
event BoxPurchased(address indexed buyer, uint256 price);
event BoxOpened(address indexed user, string rewardName, uint256 rewardValue);
event RewardAdded(string rewardName, uint256 rewardValue);
event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);
​
// Modified Functions
function buyBox() public payable {
require(msg.value == boxPrice, "Incorrect ETH sent");
boxesOwned[msg.sender] += 1;
emit BoxPurchased(msg.sender, boxPrice);
}
​
function openBox() public {
// ... reward logic
emit BoxOpened(msg.sender, rewardName, rewardValue);
}
​
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!