DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing event in `LikeRegistry::withdrawFees`, which reduces transparency

pintosric

Summary

The withdrawFeesfunction changes the totalFeesstate variable but doesn't emit an event.

Source Code:

function withdrawFees() external onlyOwner {
require(totalFees > 0, "No fees to withdraw");
uint256 totalFeesToWithdraw = totalFees;
totalFees = 0;
(bool success, ) = payable(owner()).call{value: totalFeesToWithdraw}("");
require(success, "Transfer failed");
}

Vulnerability Details

There's no on-chain record (via events) when the owner withdraws funds, making it harder for external watchers (UIs, indexers, auditors) to track fee withdrawals.

While it doesn’t introduce a security vulnerability, a malicious owner could frequently withdraw funds without an easy way for users to monitor it via event logs.

Impact

Users and external monitors cannot easily track fee withdrawals. I consider it a Low, because it doesn't affect funcionality, but reduces transparency. Specially when it comes to an action that only the owner can perform.

If users want to verify when and how much was withdrawn, they’d have to scan transactions manually, which is inefficient.

Tools Used

Slither

Recommendations

Consider adding an event to broadcast the withdrawal of the fees:

// EVENTS
+ event LikeRegistry__FeesWithdraw(address indexed owner, uint256 amount);
​
// FUNCTIONS
function withdrawFees() external onlyOwner {
require(totalFees > 0, "No fees to withdraw");
uint256 totalFeesToWithdraw = totalFees;
totalFees = 0;
(bool success, ) = payable(owner()).call{value: totalFeesToWithdraw}("");
require(success, "Transfer failed");
​
+ emit LikeRegistry__FeesWithdraw(msg.sender, totalFeesToWithdraw);
}
Updates

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.