DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Event Emission for Critical State Changes in SoulboundProfileNFT

petesol

Summary

The SoulboundProfileNFT contract fails to emit events for several critical state changes, making it difficult to track off-chain and potentially causing issues with frontend synchronization.

Vulnerability Details

In the blockProfile function:

function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
// Only emits ProfileBurned, missing specific block event
emit ProfileBurned(blockAddress, tokenId);
}

Missing events for:

  • Profile metadata updates

  • Admin actions

  • Profile state changes

Impact

  • Difficulty in tracking admin actions

  • Frontend synchronization issues

  • Limited ability to monitor contract state changes

  • Reduced transparency for users

Tools Used

  • Slither was particularly useful for identifying immutable variables that might need future updates

  • MythX and custom Semgrep rules were effective in finding missing validations

  • Coverage analysis tools helped identify gaps in validation logic

Recommendations

  1. Add specific events for admin actions:

event ProfileBlocked(address indexed user, uint256 tokenId, address indexed blockedBy);
event ProfileMetadataUpdated(uint256 indexed tokenId, string newName, uint8 newAge, string newProfileImage);

2. Emit events for all state changes:

function blockProfile(address blockAddress) external onlyOwner {
uint256 tokenId = profileToToken[blockAddress];
require(tokenId != 0, "No profile found");
​
_burn(tokenId);
delete profileToToken[blockAddress];
delete _profiles[tokenId];
​
emit ProfileBurned(blockAddress, tokenId);
emit ProfileBlocked(blockAddress, tokenId, msg.sender);
}
Updates

Appeal created

n0kto Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.