Summary

The setAdmin() function in the RockPaperScissors contract changes the admin address state variable but does not emit an event when this critical role transfer occurs. This reduces on-chain transparency and makes it difficult for external systems to monitor administrative changes.

Vulnerability Details

When the admin role is transferred to a new address using the setAdmin() function, the state change occurs but no event is emitted to signal this important change. Administrative role changes should always be accompanied by events to maintain a clear audit trail of contract governance.

The absence of an event for this administrative change makes it difficult for off-chain monitoring systems to track changes in contract governance and reduces transparency for users and stakeholders.

Impact

This issue affects the contract's transparency and auditability, making it difficult to track administrative changes through on-chain data. While it doesn't directly lead to fund loss, it reduces the ability to monitor potential security-related changes and complicates governance oversight.

The impact is considered low because:

• It doesn't directly affect contract functionality or security

• It doesn't put user funds at risk

• It's primarily an issue of transparency and best practices

Tools Used

Manual review

Recommendations

Add an event emission when the admin role is transferred:

This change follows the pattern used in OpenZeppelin's Ownable contract and significantly improves transparency around administrative changes.