Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Event Emission + Reduced Transparency

0xluckyluke

Summary

Critical contract configuration changes in EggVault::setEggNFT and EggstravaganzaNFT::setGameContract are not accompanied by event emissions, reducing transparency and making it difficult for external observers to track important state changes.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/f83ed7dff700c4319bdfd0dff796f74db5be4538/src/EggVault.sol#L22-L25

https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/f83ed7dff700c4319bdfd0dff796f74db5be4538/src/EggstravaganzaNFT.sol#L20-L23

Two key administrative functions modify critical contract parameters without emitting events:

  1. EggVault::setEggNFT - Changes the reference to the NFT contract

  1. EggstravaganzaNFT::setGameContract - Updates which contract has minting permission

The absence of events for these operations means:

  • Off-chain systems cannot easily track important configuration changes

  • Users must manually monitor contract state to be aware of changes

  • There is no permanent on-chain record of when these changes occurred and by whom

Impact

While this issue doesn't present a direct security vulnerability, it significantly reduces transparency and observability:

  • Reduces the ability to monitor contract behavior

  • Makes auditing contract history more difficult

  • Complicates integration with front-end applications and third-party services

  • Users may be unaware of changes to critical contract relationships

Tools Used

Recommendations

Add events to track changes to critical contract variables:

contract EggVault is Ownable {
+ event EggNFTUpdated(address indexed newEggNFT);
​
function setEggNFT(address _eggNFTAddress) external onlyOwner {
require(_eggNFTAddress != address(0), "Invalid NFT address");
eggNFT = EggstravaganzaNFT(_eggNFTAddress);
+ emit EggNFTUpdated(_eggNFTAddress);
}
}
​
contract EggstravaganzaNFT is ERC721, Ownable {
+ event GameContractUpdated(address indexed newGameContract);
​
function setGameContract(address _gameContract) external onlyOwner {
require(_gameContract != address(0), "Invalid game contract address");
gameContract = _gameContract;
+ emit GameContractUpdated(_gameContract);
}
}

These events allow external observers to efficiently track and react to changes in contract configuration, improving transparency and user experience.

Updates

Lead Judging Commences

m3dython Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Event Emission

Standard practice for clarifying important contract behaviors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!