Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Event Emissions for Critical State Changes Impacts Protocol Monitoring and Transparency

0xmaxi

Summary

The StrategyMainnet, StrategyOp, and StrategyArb contracts fail to emit events for critical state changes, making it difficult to track and monitor important protocol actions off-chain. This affects protocol transparency, monitoring capabilities, and the ability to build accurate historical data.

Vulnerability Details

Several critical functions that modify important state variables do not emit events

For example in StrategyOp and StrategyArb

function setRouter(address router) external onlyManagement {
router = router;
underlying.safeApprove(router, type(uint256).max);
// No event emission
}

and in StrategyMainnet

function addRoute(
address[11] calldata route,
uint256[5][5] calldata swapParams,
address[5] calldata pools
) external onlyManagement {
routes[nRoutes] = route;
swapParams[nRoutes] = swapParams;
pools[nRoutes] = pools;
nRoutes++;
// No event emission
}

Key state changes that lack events:

  1. Router address updates

  2. New route additions

  3. Route parameter modifications

  4. Pool configurations

Impact

The lack of events results in so many issues such as these:

  • Makes it difficult to track protocol changes off-chain

  • Complicates protocol monitoring and maintenance

  • Reduces transparency for users and integrators

  • Makes it harder to build accurate historical data

  • Impairs the ability to create monitoring tools and alerts

Tools Used

  • Manual review

Recommendations

Add events for all significant state changes

// For router changes
event RouterUpdated(address indexed oldRouter, address indexed newRouter);
function setRouter(address router) external onlyManagement {
address oldRouter = router;
router = router;
underlying.safeApprove(router, type(uint256).max);
emit RouterUpdated(oldRouter, router);
}
// For route additions
event RouteAdded(
uint256 indexed routeId,
address[11] route,
uint256[5][5] swapParams,
address[5] pools
);
function addRoute(
address[11] calldata route,
uint256[5][5] calldata swapParams,
address[5] calldata pools
) external onlyManagement {
routes[nRoutes] = route;
swapParams[nRoutes] = swapParams;
pools[nRoutes] = pools;
emit RouteAdded(nRoutes, route, _swapParams, _pools);
nRoutes++;
}

This will:

  • Improve protocol transparency

  • Enable better monitoring and alerting

  • Allow for accurate historical tracking

  • Facilitate protocol maintenance and debugging

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.