Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Missing explicit burn event reduces observability and auditability of owner burn operations

fawarano

Missing explicit burn event reduces observability and auditability of owner burn operations

Description

  • Sensitive owner actions (like burns) should emit a dedicated event so indexers, dashboards, and auditors can reliably track who burned what, when, and from which source.

  • burnFaucetTokens performs a burn without emitting a contract-specific event; relying only on ERC-20 Transfer(to=0) makes it hard to distinguish faucet-initiated burns from other transfers and obscures owner activity.

function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
_transfer(address(this), msg.sender, balanceOf(address(this)));
_burn(msg.sender, amountToBurn);
// @> Missing: no explicit event recording the burn origin, amount, and caller
}
​

Risk

Likelihood:

  • Burns are an administrative action expected to occur occasionally (supply adjustments, resets), so missing logs will repeatedly affect monitoring.

  • Off-chain consumers (indexers/alerts) depend on explicit events to classify actions.

Impact:

  • Poor transparency & forensics: Harder to attribute burns to owner decisions vs. generic token flows.

  • Operational gaps: Dashboards/alerts may miss or mislabel burns, complicating compliance and incident response.

Proof of Concept

A test that performs a burn cannot assert on a domain-specific event (e.g., FaucetTokensBurned) because none is emitted, forcing brittle reliance on generic Transfer(to=0) decoding.

function testBurnEmitsExplicitEvent() public {
vm.startPrank(owner);
// vm.expectEmit(); // cannot be used for a faucet-specific burn event (it doesn't exist)
raiseBoxFaucet.burnFaucetTokens(100e18);
vm.stopPrank();
// Test cannot assert an explicit burn event; observability is reduced.
}
​

Recommended Mitigation

Emit a dedicated event capturing the actor, source, and amount; emit it after a successful burn.

+ event FaucetTokensBurned(address indexed executor, address indexed from, uint256 amount);
​
function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
require(amountToBurn <= balanceOf(address(this)), "Faucet Token Balance: Insufficient");
​
_transfer(address(this), msg.sender, balanceOf(address(this)));
_burn(msg.sender, amountToBurn);
+ emit FaucetTokensBurned(msg.sender, msg.sender, amountToBurn);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 15 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.