Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

FestivalPass: No Event Emitted on ETH Withdrawal

amro135ali

Root + Impact

Description

  • The withdraw(address target) function allows the owner to withdraw ETH from the contract.

    Explain the specific issue:

    • The function does not emit an event when ETH is withdrawn, making it harder to track withdrawals on-chain and in off-chain monitoring systems.

    • This reduces transparency and makes it difficult for users, auditors, and analytics tools to monitor fund flows.

    • It also increases the risk of undetected malicious or accidental withdrawals.

// FestivalPass.sol
function withdraw(address target) external onlyOwner {
@> payable(target).transfer(address(this).balance);
// No event emitted
}

Risk

Likelihood:

  1. This will occur every time ETH is withdrawn.

  1. This will occur if off-chain monitoring tools rely on events for tracking.

  1. This will occur if users or auditors need to verify withdrawals.

  1. This will occur if there is a dispute or investigation into fund flows.

Impact:

  1. Reduced transparency for users and auditors.

  1. Harder to track withdrawals in analytics and monitoring tools.

  1. Increased risk of undetected malicious or accidental withdrawals.

  1. Loss of user trust due to lack of transparency.

Proof of Concept

// No FundsWithdrawn event emitted in withdraw()

Recommended Mitigation

- payable(target).transfer(address(this).balance);
+ uint256 amount = address(this).balance;
+ payable(target).transfer(amount);
+ emit FundsWithdrawn(target, amount);
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing events / Events not properly configured

Informational. This protocol doesn't rely on events to function, they are just nice to have, but not mandatory.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.