Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

State Change Without Event Emission

jobmwitah

Summary

State Change Without Event Emission

Vulnerability Details

Several functions modify state variables but do not emit events, making it difficult for off-chain applications (e.g., indexers, front-ends) to track these changes. This lack of transparency can hinder monitoring and user experience.

Instances:

EggHuntGame::setEggFindThreshold Line: 58 (src/EggHuntGame.sol#L58):

​
function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold; // State change, no event
}

EggVault::setEggNFT Line: 22 (src/EggVault.sol#L22):

​
function setEggNFT(address _eggNFTAddress) external onlyOwner {
require(_eggNFTAddress != address(0), "Invalid NFT address");
eggNFT = EggstravaganzaNFT(_eggNFTAddress); // State change, no event
}

EggstravaganzaNFT::setGameContract Line: 20 (src/EggstravaganzaNFT.sol#L20):

​
function setGameContract(address _gameContract) external onlyOwner {
require(_gameContract != address(0), "Invalid game contract address");
gameContract = _gameContract; // State change, no event
}

EggstravaganzaNFT::mintEgg Line: 27 (src/EggstravaganzaNFT.sol#L27):

​
function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_mint(to, tokenId);
totalSupply += 1; // State change, no event
return true;
}

Impact

Without events, off-chain systems cannot easily detect changes to critical variables like eggFindThreshold, eggNFT, gameContract, or totalSupply. This could lead to outdated UIs, missed updates in analytics, or difficulty auditing the game’s state.

Tools Used

  • Manual review

  • Aderyn static analyzer

Recommendations

Add events to each function to log state changes. For example:
In EggHuntGame:

​
event EggFindThresholdUpdated(uint256 newThreshold);
​
function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold;
emit EggFindThresholdUpdated(newThreshold);
}

These events improve transparency and enable off-chain tracking.

Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Event Emission

Standard practice for clarifying important contract behaviors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.