Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

configure pass function does not emit any events

kennisnutz2

Root + Impact

Description

It is conventional to emit an event everytime the contract's storage has been modified by a function. However the configurePass function does not emit any event.

function configurePass(
uint256 passId,
uint256 price,
uint256 maxSupply
) external onlyOrganizer {
require(passId == GENERAL_PASS || passId == VIP_PASS || passId == BACKSTAGE_PASS, "Invalid pass ID");
require(price > 0, "Price must be greater than 0");
require(maxSupply > 0, "Max supply must be greater than 0");
​
passPrice[passId] = price;
passMaxSupply[passId] = maxSupply;
passSupply[passId] = 0; // Reset current supply
}

Risk

Likelihood:

  • whenever the configurePass function is called


Impact:

  • Without emitting an event, there’s no on-chain log of when the function was called or what the new configuration values were.

  • Users, developers, and external auditors cannot easily track configuration changes (like price updates or supply resets) without directly querying the contract state.

  • DApps, dashboards, or third-party tools like The Graph or block explorers rely on events to listen for contract changes efficiently.


  • Without an event, UIs must poll the contract constantly to detect changes — which is inefficient and more expensive.

​

Recommended Mitigation

function configurePass(
uint256 passId,
uint256 price,
uint256 maxSupply
) external onlyOrganizer {
require(passId == GENERAL_PASS || passId == VIP_PASS || passId == BACKSTAGE_PASS, "Invalid pass ID");
require(price > 0, "Price must be greater than 0");
require(maxSupply > 0, "Max supply must be greater than 0");
​
passPrice[passId] = price;
passMaxSupply[passId] = maxSupply;
passSupply[passId] = 0; // Reset current supply
+ emit PassConfigured(passId, price, maxSupply)
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing events / Events not properly configured

Informational. This protocol doesn't rely on events to function, they are just nice to have, but not mandatory.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.