DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Event emission after external call in `MultiSigWallet::executeTransaction` can lead to missing or incorrect event logs

oks_oks

Description: The executeTransaction function emits the TransactionExecuted event after making an external call. If the external call triggers a revert in the recipient's fallback/receive function, the event will never be emitted, leading to inconsistent off-chain tracking.

function executeTransaction(uint256 _txId) external onlyOwners {
...
​
txn.executed = true;
(bool success,) = payable(txn.to).call{value: txn.value}(""); // External call
require(success, "Transaction failed");
​
@> emit TransactionExecuted(_txId, txn.to, txn.value); // May never be emitted if call reverts
}

Impact:

  • Off-chain systems (like front-ends, analytics, or monitoring tools) may miss successful transactions

  • Transaction history will be incomplete

  • Difficulty in tracking and auditing multisig wallet activity

Proof of Concept:

  1. A transaction is approved and executed

  2. The state is updated (txn.executed = true)

  3. The external call is made but the receiving contract reverts

  4. The function reverts due to require(success)

  5. The event is never emitted, even though the transaction was marked as executed

  6. The contract state and event logs are now out of sync

Recommended Mitigation: Move the event emission before the external call to ensure it's always emitted when a transaction is marked as executed:

function executeTransaction(uint256 _txId) external onlyOwners {
...
txn.executed = true;
+ emit TransactionExecuted(_txId, txn.to, txn.value);
​
(bool success,) = payable(txn.to).call{value: txn.value}("");
require(success, "Transaction failed");
​
- emit TransactionExecuted(_txId, txn.to, txn.value);
}

This ensures that the event is always emitted when the transaction is marked as executed, maintaining consistency between contract state and event logs.

Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.