Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Graduated event not emitted during major contract upgrade

0xarektq

Summary

The Graduated event is defined but never emitted in the contract. In particular, the graduateAndUpgrade() function, which performs a significant contract upgrade and distributes funds, fails to emit this event, reducing transparency and observability for off-chain systems.

Vulnerability Details

The contract defines an event:

event Graduated(address indexed levelTwo);

However, this event is never emitted, not even in the critical LevelOne::graduateAndUpgrade() function, which performs a major state transition and contract upgrade.

This is a critical operation that changes the logic contract via UUPS, but it does not emit any event to signal this state transition to external observers.

Impact

  • No functional vulnerability or on-chain risk.

  • Reduces transparency of major system transitions (like upgrades).

  • Breaks best practices and limits integration with off-chain tools (e.g. The Graph, indexers, analytics dashboards, or governance tracking systems).

  • Makes it harder for DApps or users to react to upgrades, increasing operational risk.

Tools Used

  • Manual code review

Recommendations

Emit the Graduated event after a successful upgrade and before the function completes:

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
uint256 totalTeachers = listOfTeachers.length;
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
-> emit Graduated(_levelTwo);
​
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

no event

Event not emitted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.