Inheritable Smart Contract Wallet
First Flight #35
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Events for Critical Operations

kweks

Description

The NFTFactory contract does not emit events for essential state-changing operations, specifically during the creation of new NFT estates via the createEstate() function and the destruction of existing NFTs via the burnEstate() function. Events are essential components of smart contracts as they provide an efficient mechanism for off-chain applications to track on-chain activities.

Vulnerability Analysis

The following functions lack event emissions:

function createEstate(string memory description) external onlyInheritanceManager returns (uint256 itemID) {
uint256 ID = _incrementCounter();
_mint(msg.sender, ID);
_setTokenURI(ID, description);
return ID;
// No event emitted
}
​
function burnEstate(uint256 _id) external onlyInheritanceManager {
_burn(_id);
// No event emitted
}
​

While these functions correctly modify the contract state, they fail to notify external systems about these changes through events.

Impact

The absence of events for critical operations has several negative consequences:

  1. Reduced Transparency: External stakeholders cannot easily track the creation and destruction of NFT estates without parsing all blockchain transactions.

  2. Dapp Integration Difficulties: Frontend applications and other dapps that need to react to NFT creation or destruction must implement complex workarounds to detect these operations.

  3. Monitoring Challenges: Security monitoring tools and analytics platforms cannot efficiently track the activity of the contract, potentially missing important state changes.

  4. Indexing Issues: NFT indexers and marketplaces that rely on events to catalog NFTs may not properly recognize tokens from this contract.

  5. Historical Tracking: Without events, creating a historical record of all estates ever minted becomes significantly more complex and resource-intensive.

Proof of Concept

The issue can be demonstrated through code inspection, as shown above. In a blockchain explorer or monitoring tools, there would be no specific filterable events when NFTs are created or burned, forcing reliance on transaction data alone.

Remediation

Implement relevant events for all critical state-changing operations:

// Event declarations
event EstateMinted(uint256 indexed tokenId, address indexed owner, string uri);
event EstateBurned(uint256 indexed tokenId, address indexed burner);
​
function createEstate(string memory description) external onlyInheritanceManager returns (uint256 itemID) {
uint256 ID = _incrementCounter();
_mint(msg.sender, ID);
_setTokenURI(ID, description);
emit EstateMinted(ID, msg.sender, description);
return ID;
}
​
function burnEstate(uint256 _id) external onlyInheritanceManager {
address owner = ownerOf(_id); // Capture owner before burning
_burn(_id);
emit EstateBurned(_id, msg.sender);
}
​

The events should include:

  • Indexed parameters for efficient filtering

  • All relevant information about the operation

  • Proper naming to indicate the action performed

Recommendations

  1. Add all necessary events as shown in the remediation section.

  2. Consider adding additional informative data to the events to make them more useful for off-chain analysis.

  3. Review other functions for any state-changing operations that should emit events.

  4. Consider following the OpenZeppelin ERC721 implementation patterns more strictly, which includes comprehensive event emissions.

  5. Document the event structure in developer documentation to facilitate integration with external systems.

This issue should be addressed before production deployment to ensure proper contract transparency and integration capabilities.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!