Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of event emission for Critical Functions

mozi

Lack of event emission for Critical Functions

Description

There is lack of event emission for Critical Functions such as:

  1. BidBeastsNFTMarket::_payout(), whenever the transfer is failed its amounts is transfered into failedTransferCredits mapping without emitting an event.

  2. BidBeastNFTMarket::withdrawAllFailedCredits(), so the failed transfered amounts from BidBeastsNFTMarket::_payout() can be withdrawn by calling this function. Unfortunately, this function also not emitting an event whenever someone withdraw.

  • In BidBeastsNFTMarket::_payout() function :

function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success, ) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
@> // no event emission
}
}

  • In BidBeastNFTMarket::withdrawAllFailedCredits() function :

function withdrawAllFailedCredits(address _receiver) external {
uint256 amount = failedTransferCredits[_receiver];
require(amount > 0, "No credits to withdraw");
​
failedTransferCredits[msg.sender] = 0;
​
(bool success, ) = payable(msg.sender).call{value: amount}("");
require(success, "Withdraw failed");
@> // no event emission
}

Risk

Likelihood:

  • When User/Bidder is a contract and the contract does not implement receive()/fallback() function its amounts is transfered into failedTransferCredits mapping

Impact:

  • It will confuse user/bidder, espeacially when _payout failed

Recommended Mitigation

create new events for _payout and withdrawAllFailedCredits

+ event FailedTransfer(address to, uint256 amount);
+ event WithdrawFailedCredits(address to, uint256 amount);
​
function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success, ) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
+ emit FailedTransfer(recipient, amount)
}
}
​
function withdrawAllFailedCredits(address _receiver) external {
uint256 amount = failedTransferCredits[_receiver];
require(amount > 0, "No credits to withdraw");
​
failedTransferCredits[msg.sender] = 0;
​
+ emit WithdrawFailedCredits(msg.sender, amount);
(bool success, ) = payable(msg.sender).call{value: amount}("");
require(success, "Withdraw failed");
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.