Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Missing Events for Critical State Changes

the2ke

Root + Impact

Description

  • Smart contracts are expected to emit events when key state changes occur, especially when they involve protocol configuration, fund transfers, or updates that affect off-chain behavior.Explain the specific issue or problem in one or more sentences

  • The FestivalPass contract fails to emit events in critical functions like setOrganizer, configurePass, and withdraw. This reduces off-chain observability, limits frontend reactivity, and impacts transparency and indexer support.

function setOrganizer(address _organizer) public onlyOwner {
@> organizer = _organizer;
@> // No event emitted for this important state change
}
​
function configurePass(uint256 passId, uint256 price, uint256 maxSupply) external onlyOrganizer {
...
@> passPrice[passId] = price;
@> passMaxSupply[passId] = maxSupply;
@> passSupply[passId] = 0;
@> // No event emitted for price, maxSupply changes
}
​
function withdraw(address target) external onlyOwner {
@> payable(target).transfer(address(this).balance);
@> // No event emitted for ETH transfer
}
​

Risk

Likelihood:

  • This will occur every time the owner or organizer changes contract parameters or withdraws funds.

Impact:

  • Protocol users and off-chain systems will be unaware of changes to pass pricing or organizer transitions.

  • No verifiable trail of fund withdrawals or configuration changes

Proof of Concept

​

Recommended Mitigation

function setOrganizer(address _organizer) public onlyOwner {
organizer = _organizer;
+ emit OrganizerUpdated(_organizer);
}
​
function configurePass(uint256 passId, uint256 price, uint256 maxSupply) external onlyOrganizer {
...
passSupply[passId] = 0;
+ emit PassConfigured(passId, price, maxSupply);
}
​
function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
+ emit FundsWithdrawn(target, address(this).balance);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing events / Events not properly configured

Informational. This protocol doesn't rely on events to function, they are just nice to have, but not mandatory.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.