Snowman Merkle Airdrop

First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Submission Details
Impact: low
Likelihood: low
Invalid

[L-3] collectFee() does not emit the FeeCollected() event and event listeners will never know when fee is collected

[L-3] Snow::collectFee() does not emit the FeeCollected() event and event listeners will never know when fee is collected

Description

  • The collectFee() function allows user to collect the fees accumulated. However, no events are emitted when the function is called.

function collectFee() external onlyCollector {
uint256 collection = i_weth.balanceOf(address(this));
i_weth.transfer(s_collector, collection);
(bool collected,) = payable(s_collector).call{value: address(this).balance}("");
require(collected, "Fee collection failed!!!");
}

Risk

Likelihood:

  • Whenever the collectFee() event is called to collect the fee from protocol

Impact:

  • Frontends depending on event emission to detect when fee is collected will never be able to update because no events are emitted

Proof of Concept

The FeeCollected event is defined in the contract like the following:

event FeeCollected();

However, it has never been used in the contract.

Recommended Mitigation:

Modify the collectFee() function to be like the following so that, every time fee is collected using this function, an event will be emitted and thus, any frontend that depend on an event emission will be able to update properly. It has been put on top of the transfer calls to prevent reentrancy attacks.

function collectFee() external onlyCollector {
+ emit FeeCollected();
uint256 collection = i_weth.balanceOf(address(this));
i_weth.transfer(s_collector, collection);
(bool collected,) = payable(s_collector).call{value: address(this).balance}("");
require(collected, "Fee collection failed!!!");
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.