Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Event Emission + Reduced Transparency

0xluckyluke

Summary

Critical contract configuration changes in EggVault::setEggNFT and EggstravaganzaNFT::setGameContract are not accompanied by event emissions, reducing transparency and making it difficult for external observers to track important state changes.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/f83ed7dff700c4319bdfd0dff796f74db5be4538/src/EggVault.sol#L22-L25

https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/f83ed7dff700c4319bdfd0dff796f74db5be4538/src/EggstravaganzaNFT.sol#L20-L23

Two key administrative functions modify critical contract parameters without emitting events:

  1. EggVault::setEggNFT - Changes the reference to the NFT contract

  1. EggstravaganzaNFT::setGameContract - Updates which contract has minting permission

The absence of events for these operations means:

  • Off-chain systems cannot easily track important configuration changes

  • Users must manually monitor contract state to be aware of changes

  • There is no permanent on-chain record of when these changes occurred and by whom

Impact

While this issue doesn't present a direct security vulnerability, it significantly reduces transparency and observability:

  • Reduces the ability to monitor contract behavior

  • Makes auditing contract history more difficult

  • Complicates integration with front-end applications and third-party services

  • Users may be unaware of changes to critical contract relationships

Tools Used

Recommendations

Add events to track changes to critical contract variables:

contract EggVault is Ownable {
+ event EggNFTUpdated(address indexed newEggNFT);
​
function setEggNFT(address _eggNFTAddress) external onlyOwner {
require(_eggNFTAddress != address(0), "Invalid NFT address");
eggNFT = EggstravaganzaNFT(_eggNFTAddress);
+ emit EggNFTUpdated(_eggNFTAddress);
}
}
​
contract EggstravaganzaNFT is ERC721, Ownable {
+ event GameContractUpdated(address indexed newGameContract);
​
function setGameContract(address _gameContract) external onlyOwner {
require(_gameContract != address(0), "Invalid game contract address");
gameContract = _gameContract;
+ emit GameContractUpdated(_gameContract);
}
}

These events allow external observers to efficiently track and react to changes in contract configuration, improving transparency and user experience.

Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Event Emission

Standard practice for clarifying important contract behaviors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.