Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of event emission for Critical Functions

mozi

Lack of event emission for Critical Functions

Description

There is lack of event emission for Critical Functions such as:

  1. BidBeastsNFTMarket::_payout(), whenever the transfer is failed its amounts is transfered into failedTransferCredits mapping without emitting an event.

  2. BidBeastNFTMarket::withdrawAllFailedCredits(), so the failed transfered amounts from BidBeastsNFTMarket::_payout() can be withdrawn by calling this function. Unfortunately, this function also not emitting an event whenever someone withdraw.

  • In BidBeastsNFTMarket::_payout() function :

function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success, ) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
@> // no event emission
}
}

  • In BidBeastNFTMarket::withdrawAllFailedCredits() function :

function withdrawAllFailedCredits(address _receiver) external {
uint256 amount = failedTransferCredits[_receiver];
require(amount > 0, "No credits to withdraw");
​
failedTransferCredits[msg.sender] = 0;
​
(bool success, ) = payable(msg.sender).call{value: amount}("");
require(success, "Withdraw failed");
@> // no event emission
}

Risk

Likelihood:

  • When User/Bidder is a contract and the contract does not implement receive()/fallback() function its amounts is transfered into failedTransferCredits mapping

Impact:

  • It will confuse user/bidder, espeacially when _payout failed

Recommended Mitigation

create new events for _payout and withdrawAllFailedCredits

+ event FailedTransfer(address to, uint256 amount);
+ event WithdrawFailedCredits(address to, uint256 amount);
​
function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success, ) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
+ emit FailedTransfer(recipient, amount)
}
}
​
function withdrawAllFailedCredits(address _receiver) external {
uint256 amount = failedTransferCredits[_receiver];
require(amount > 0, "No credits to withdraw");
​
failedTransferCredits[msg.sender] = 0;
​
+ emit WithdrawFailedCredits(msg.sender, amount);
(bool success, ) = payable(msg.sender).call{value: amount}("");
require(success, "Withdraw failed");
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!