Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Event Emission in Key Administrative Functions

0xalipede

Summary

The EggHuntGame, EggstravaganzaNFT and EggVault contracts contain several functions where changes to critical contract parameters do not emit events. This lack of event emission reduces transparency and makes it difficult for off-chain monitoring tools to track changes in real-time.

Vulnerability Details

Affected code:

The following functions do not emit events when executed by the contract owner:

  • setEggFindThreshold (EggHuntGame.sol)

function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold;
}

  • setGameContract (EggstravaganzaNFT.sol)

function setGameContract(address _gameContract) external onlyOwner {
require(_gameContract != address(0), "Invalid game contract address");
gameContract = _gameContract;
}

  • setEggNFT (EggVault.sol)

function setEggNFT(address _eggNFTAddress) external onlyOwner {
require(_eggNFTAddress != address(0), "Invalid NFT address");
eggNFT = EggstravaganzaNFT(_eggNFTAddress);
}

Impact

  • Reduced Transparency: Users and external monitoring tools cannot track changes efficiently.

  • Potential Exploitation: Silent updates could lead to unfair advantages if contract parameters are modified without notice.

  • Difficult Debugging: Developers and auditors may struggle to identify when and why key parameters were modified.

Tools Used

  • Manual review

Recommendations

To enhance transparency and traceability, each of these functions should emit an event when executed.

Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Event Emission

Standard practice for clarifying important contract behaviors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.