Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Payout Events Causing Frontend ETH Balance Miscalculation

empyrean

Missing Payout Events Causing Frontend ETH Balance Miscalculation

Description

_payout transfers ETH without emitting events for successful calls, causing frontends relying on event logs to miss outflows and miscalculate contract ETH balance.

function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success,) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
}
@>// No event here@>
}

Risk

Likelihood:

  • On every successful ETH refund or payout during bidding/settlement.

  • When frontend databases sync via event logs only.

Impact:

  • Inflated contract balance display, misleading users on funds.

Proof of Concept

Shows _payout code with no emit statement; successful transfers go unlogged, so frontends miss ETH outflows when parsing events.

function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success,) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
}
@>// No event here@>
}

Recommended Mitigation

Adds Payout event; emits it after transfer regardless of success, letting frontends track all ETH movements accurately.

+event Payout(address indexed recipient, uint256 amount); // Add event
​
function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success,) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
}
+ emit Payout(recipient, amount); // Emit regardless of success for tracking
}
Updates

Lead Judging Commences

cryptoghost Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.