Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[M-5] Inadequate Event Emissions for Critical State Changes

nymuelis

Severity

Medium

Impact

Many critical state-changing functions in the contract don't emit events, making it difficult to track off-chain. This reduces transparency, complicates integration with external systems, and makes it harder to monitor the contract for security issues or verify expected behavior.

Description

All important state changes should emit events. However, several critical functions in the contract are missing events:

  1. Initialize Function: No event when the contract is initialized

function initialize(address _principal, uint256 _schoolFees, address _usdcAddress) public initializer {
// No event emitted
}

  1. GraduateAndUpgrade Function: No event indicating graduation, upgrade, or payments

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// No event emitted
}

  1. _authorizeUpgrade Function: No event when upgrade is authorized

function _authorizeUpgrade(address newImplementation) internal override onlyPrincipal {}

  1. CutOffScore Setting: The SchoolInSession event doesn't include the cutOffScore parameter

function startSession(uint256 _cutOffScore) public onlyPrincipal notYetInSession {
sessionEnd = block.timestamp + 4 weeks;
inSession = true;
cutOffScore = _cutOffScore;
​
emit SchoolInSession(block.timestamp, sessionEnd);
// cutOffScore is not included in the event
}

This lack of event emissions makes it difficult to:

  1. Track the contract's state changes off-chain

  2. Build interfaces that respond to contract changes

  3. Conduct post-mortem analysis if issues occur

  4. Verify the contract is functioning as expected

Tools Used

Manual code review

Recommended Mitigation

Add events for all critical state changes:

+ event HawkHighInitialized(address indexed principal, uint256 schoolFees, address usdcAddress);
+ event SchoolUpgraded(address indexed newImplementation, uint256 remainingBursary);
+ event TeacherPaymentSent(address indexed teacher, uint256 amount);
+ event PrincipalPaymentSent(address indexed principal, uint256 amount);
​
function initialize(address _principal, uint256 _schoolFees, address _usdcAddress) public initializer {
// ... existing code ...
+ emit HawkHighInitialized(_principal, _schoolFees, _usdcAddress);
}
​
- emit SchoolInSession(block.timestamp, sessionEnd);
+ emit SchoolInSession(block.timestamp, sessionEnd, _cutOffScore);
​
function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// ... existing code ...
_authorizeUpgrade(_levelTwo);
+ emit SchoolUpgraded(_levelTwo, bursary - (totalTeachers * payPerTeacher) - principalPay);
​
for (uint256 n = 0; n < totalTeachers; n++) {
usdc.safeTransfer(listOfTeachers[n], payPerTeacher);
+ emit TeacherPaymentSent(listOfTeachers[n], payPerTeacher);
}
​
usdc.safeTransfer(principal, principalPay);
+ emit PrincipalPaymentSent(principal, principalPay);
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

no event

Event not emitted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.