Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Important Event `IFestivalPass::FundsWithdrawn` Declared but Not Emitted on `FestivalPass::withdraw` function.

ayb

[L-3] Important Event IFestivalPass::FundsWithdrawn Declared but Not Emitted on FestivalPass::withdraw function.

Description: The IFestivalPass::FundsWithdrawn event is declared but the FestivalPass::withdraw function does not emit this event when funds are withdrawn. This reduces protocol transparency and makes it harder for off-chain services and users to monitor withdrawals and track on-chain activity.
While the access control issue (onlyOwner vs onlyOrganizer) is addressed separately in [M-1], this finding specifically focuses on the absence of an event.

Impact:

  • Off-chain services, block explorers, and users cannot reliably detect when funds are withdrawn from the contract.

  • Reduces protocol transparency and makes it difficult to monitor or audit withdrawals.

  • May hinder integration with monitoring tools, analytics platforms, or alerting systems.

Proof of Concept: Add this into your FestivalPass.t.sol:

function test_withdrawEvent() public {
// Users buy passes
vm.prank(user1);
festivalPass.buyPass{value: GENERAL_PRICE}(1);
vm.prank(user2);
festivalPass.buyPass{value: VIP_PRICE}(2);
// This test fails, proving no FundsWithdrawn event is emitted during withdrawal
vm.prank(owner);
vm.expectEmit(true, false, false, true);
festivalPass.withdraw(organizer);
}

A Foundry test using vm.expectEmit(...) fails when calling festivalPass.withdraw(), proving that the IFestivalPass::FundsWithdrawn event is not emitted.

Recommended Mitigation: Add the event emission to the withdraw function to ensure that all withdrawals are logged on-chain:

function withdraw(address target) external onlyOwner {
+ uint256 amount = address(this).balance;
- payable(target).transfer(address(this).balance);
+ payable(target).transfer(amount);
+ emit FundsWithdrawn(msg.sender, amount);
}

This ensures transparent and traceable withdrawals.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing events / Events not properly configured

Informational. This protocol doesn't rely on events to function, they are just nice to have, but not mandatory.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.