Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Payout Events Causing Frontend ETH Balance Miscalculation

empyrean

Missing Payout Events Causing Frontend ETH Balance Miscalculation

Description

_payout transfers ETH without emitting events for successful calls, causing frontends relying on event logs to miss outflows and miscalculate contract ETH balance.

function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success,) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
}
@>// No event here@>
}

Risk

Likelihood:

  • On every successful ETH refund or payout during bidding/settlement.

  • When frontend databases sync via event logs only.

Impact:

  • Inflated contract balance display, misleading users on funds.

Proof of Concept

Shows _payout code with no emit statement; successful transfers go unlogged, so frontends miss ETH outflows when parsing events.

function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success,) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
}
@>// No event here@>
}

Recommended Mitigation

Adds Payout event; emits it after transfer regardless of success, letting frontends track all ETH movements accurately.

+event Payout(address indexed recipient, uint256 amount); // Add event
​
function _payout(address recipient, uint256 amount) internal {
if (amount == 0) return;
(bool success,) = payable(recipient).call{value: amount}("");
if (!success) {
failedTransferCredits[recipient] += amount;
}
+ emit Payout(recipient, amount); // Emit regardless of success for tracking
}
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeasts Marketplace: Incorrect Event Emission

placeBid emits AuctionSettled even though the auction hasn’t ended, causing misleading event logs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!