Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Events Not Declared or Emitted

cyber00t

Description

  • The IFestivalPass interface declares several important events such as PassPurchased, PerformanceCreated, MemorabiliaRedeemed, and others.

  • In the FestivalPass implementation contract, not all declared events are emitted, and in some cases, the implementation is missing the event entirely.

  • This breaks interface compliance expectations, reduces transparency, and complicates off-chain event indexing or frontend listening logic.

interface IFestivalPass {
event FundsWithdrawn(address indexed organizer, uint256 amount);
event CollectionCreated(uint256 indexed collectionId, string name, uint256 maxSupply);
...
}
​
contract FestivalPass {
...
// @> CollectionCreated is declared in the interface but not emitted in the implementation
// @> FundsWithdrawn also declared, but no emit call present
}
​

Risk

Likelihood:

  • Developers using the interface expect the implementation to emit all declared events during execution.

  • DApps listening for lifecycle events will miss key updates, such as fund withdrawals or new collection creation, if events are not emitted

Impact:

  • Breaks composability and trust for anyone integrating based on the interface (e.g., analytics dashboards, subgraphs).

  • Reduces visibility of sensitive admin actions like withdraw() or createMemorabiliaCollection().

  • Prevents real-time UI updates or history indexing in off-chain systems.

Proof of Concept

festivalPass.withdraw(owner);
// No FundsWithdrawn event emitted
​
festivalPass.createMemorabiliaCollection("Posters", "ipfs://xyz", 100, 50, true);
// No CollectionCreated event emitted
​

Recommended Mitigation

function withdraw(address target) external onlyOwner {
uint256 amount = address(this).balance;
(bool sent, ) = target.call{value: amount}("");
require(sent, "Withdraw failed");
+ emit FundsWithdrawn(msg.sender, amount);
}
​
function createMemorabiliaCollection(...) external onlyOwner returns (uint256) {
...
+ emit CollectionCreated(collectionId, name, maxSupply);
}
​

If some events are meant to be declared but never emitted, consider removing them from the interface to reflect actual usage.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing events / Events not properly configured

Informational. This protocol doesn't rely on events to function, they are just nice to have, but not mandatory.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.