Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

No Event Emitted on ETH Withdrawal

r4y4n3

Root + Impact

Description

  • Normal Behavior:
    When ETH is withdrawn from the contract, an event should be emitted to record the withdrawal. This allows off-chain services, auditors, and users to track fund movements and monitor contract activity. Emitting events for critical actions is a best practice in smart contract development, as it improves transparency and accountability.

    Issue:
    The withdraw(address target) function does not emit any event when ETH is withdrawn. As a result, there is no on-chain record of withdrawals, making it difficult to audit fund flows, monitor suspicious activity, or integrate with off-chain analytics and monitoring tools. This lack of transparency can hinder security reviews and user trust.

function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
// No event emitted here
}

Risk

Likelihood:

  • Every withdrawal is missing an on-chain record, which can hinder transparency and auditing.

Impact:

  • While this does not affect contract logic or user funds directly, it reduces transparency and makes off-chain monitoring more difficult.

Proof of Concept

Whenever the owner calls, No event is emitted, so off-chain systems and users cannot track when or how much ETH was withdrawn, or to which address. This can make it difficult to detect unauthorized or suspicious withdrawals.

// This call will withdraw all contract ETH to the owner, but no event is emitted for off-chain tracking.
festival.withdraw(owner);

Recommended Mitigation

Emit an event whenever ETH is withdrawn from the contract. This event should include the recipient address and the amount withdrawn.

+ event FundsWithdrawn(address indexed target, uint256 amount);
​
function withdraw(address target) external onlyOwner {
uint256 amount = address(this).balance;
payable(target).transfer(amount);
+ emit FundsWithdrawn(target, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 26 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing events / Events not properly configured

Informational. This protocol doesn't rely on events to function, they are just nice to have, but not mandatory.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.