Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Event Emissions in SpookySwap Smart Contract

tm2

Summary

The SpookySwap contract lacks event emissions for critical state-changing functions like setTreatCost and resolveTrick. This omission hinders transparency and makes it challenging to monitor and track essential operations off-chain. Without these events, stakeholders cannot reliably detect changes to treat costs or the resolution of pending NFT purchases, leading to reduced trust and potential difficulties in auditing and interfacing with the contract.

Vulnerability Details

function setTreatCost(string memory _treatName, uint256 _cost) public onlyOwner {
require(treatList[_treatName].cost > 0, "Treat must cost something.");
treatList[_treatName].cost = _cost;
}

The setTreatCost function allows the contract owner to update the cost of a specific treat. However, it does not emit an event to signal that a treat's cost has been modified.

function resolveTrick(uint256 tokenId) public payable nonReentrant {
require(pendingNFTs[tokenId] == msg.sender, "Not authorized to complete purchase");
​
string memory treatName = tokenIdToTreatName[tokenId];
Treat memory treat = treatList[treatName];
​
uint256 requiredCost = treat.cost * 2; // Double price
uint256 amountPaid = pendingNFTsAmountPaid[tokenId];
uint256 totalPaid = amountPaid + msg.value;
​
require(totalPaid >= requiredCost, "Insufficient ETH sent to complete purchase");
​
// Transfer the NFT to the buyer
_transfer(address(this), msg.sender, tokenId);
​
// Clean up storage
delete pendingNFTs[tokenId];
delete pendingNFTsAmountPaid[tokenId];
delete tokenIdToTreatName[tokenId];
​
// Refund excess ETH if any
if (totalPaid > requiredCost) {
uint256 refund = totalPaid - requiredCost;
(bool refundSuccess,) = msg.sender.call{value: refund}("");
require(refundSuccess, "Refund failed");
}
}

he resolveTrick function finalizes pending NFT purchases by transferring the NFT to the user and handling refunds. However, it does not emit any event to indicate that a pending purchase has been resolved.

Impact

The absence of events in the functions means that there is no on-chain traceability or transparency when the data is updated.

Tools Used

Manual review

Recommendations

For improved transparency and traceability, it’s recommended to emit events in key functions of your smart contracts. Events act as a communication bridge between the blockchain and off-chain applications, enabling users, developers, and external services to monitor contract activity effectively.

Updates

Appeal created

bube Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.