Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Missing event emission in `FestivalPass::withdraw`.

mustby

Missing event emission in FestivalPass::withdraw.

Description: There is no event emission in the function FestivalPass::withdraw. This means anybody querying for the balance of the contract will get incorrect results since it is not updated upon the withdrawal.

// Organizer withdraws ETH
function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}

In the IFestivalPass.sol, we can see that there is an unused event. Because of the presence of this event, the intention must've been that it would be used in the FestivalPass::withdraw function. Note the code below:

/**
* @notice Emitted when the organizer withdraws collected funds
* @param organizer Address of the organizer
* @param amount Amount of ETH withdrawn
*/
event FundsWithdrawn(address indexed organizer, uint256 amount);

Impact:

Likelihood: MEDIUM

  • Withdrawals will likely happen regularly.

Impact: VERY LOW


Proof of Concept:

N/A


Recommended Mitigation:

I would recommend adding the event line directly in the withdraw function.

function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
+ emit FundsWithdrawn(address indexed owner, uint256 amount);
}

Note that I've ALSO updated the event to reflect the "owner" being the withdrawer versus the organizer. This is fully reflected in another writeup.

/**
+ * @notice Emitted when the owner withdraws collected funds
+ * @param owner Address of the owner
- * @notice Emitted when the organizer withdraws collected funds
- * @param organizer Address of the organizer
* @param amount Amount of ETH withdrawn
*/
+ event FundsWithdrawn(address indexed owner, uint256 amount);
- event FundsWithdrawn(address indexed organizer, uint256 amount);
Updates

Lead Judging Commences

inallhonesty Lead Judge 26 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing events / Events not properly configured

Informational. This protocol doesn't rely on events to function, they are just nice to have, but not mandatory.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.