Root + Impact

Description

• Normal Behavior:
  When the festival contract address is set via setFestivalContract, an event should be emitted to record this critical change. This allows off-chain services, auditors, and users to track when and to what address the festival contract was assigned.

  Issue:
  The setFestivalContract function does not emit any event when the festival contract address is set. As a result, there is no on-chain record of this action, making it difficult to audit, monitor, or react to changes in the contract’s configuration.

Risk

Likelihood:

• This function is called at least once per deployment, and the lack of an event makes it harder to track contract state changes, especially in production or multi-admin environments.

Impact:

• While this does not affect contract logic or user funds directly, it reduces transparency, makes off-chain monitoring more difficult, and can complicate audits or incident investigations.

Proof of Concept

Whenever the owner calls, No event is emitted, so off-chain systems and users cannot track when or to which address the festival contract was set.

Recommended Mitigation

Emit an event whenever the festival contract address is set.