Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of event emission in setEggFindThreshold hides critical game logic changes

jfornells

Description:

The function EggHuntGame::setEggFindThreshold allows the contract owner to change the probability that a player finds an egg in searchForEgg(). This parameter directly influences the distribution of rewards (NFTs) in the game.

However, this update is performed silently: no event is emitted, and the change is only visible by calling the contract state manually. This creates a transparency issue where users, auditors, bots, and other contracts cannot detect when or how the threshold is modified.

Since this change affects gameplay and can be performed unilaterally by the owner, it should be publicly traceable. Otherwise, the owner could manipulate the outcome probabilities without users being aware (e.g., reduce to 0% or increase to 100% without notice).

Even if the frontend reflects the updated value, relying on off-chain sources undermines the trustless nature of the system.

Impact:

  • Users have no visibility into changes in win probability.

  • The threshold can be silently modified in favor of specific users or events.

  • This weakens fairness and verifiability of the game logic.

  • Reduces auditability and trust in a blockchain-based reward mechanism.

Tools Used

Manual review, Foundry

Recommended Mitigation:

+ event EggFindThresholdUpdated(uint256 oldThreshold, uint256 newThreshold);
​
function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
uint256 old = eggFindThreshold;
eggFindThreshold = newThreshold;
+ emit EggFindThresholdUpdated(old, newThreshold);
}
​
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Event Emission

Standard practice for clarifying important contract behaviors

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.