Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

No event emitted in adjustDailyClaimLimit function

hawks

Root + Impact

Description

In function adjustDailyClaimLimit no event is emitted when the claim limit is updated.

This results in a lack of transparency, as off-chain systems such as explorers, dApps, and monitoring tools cannot detect when the daily claim limit is changed. Additionally, this makes auditing more difficult, as there is no on-chain record of previous values or when changes occurred.


function adjustDailyClaimLimit(uint256 by, bool increaseClaimLimit) public onlyOwner {
if (increaseClaimLimit) {
dailyClaimLimit += by;
} else {
if (by > dailyClaimLimit) {
revert RaiseBoxFaucet_CurrentClaimLimitIsLessThanBy();
}
dailyClaimLimit -= by;
}
}

Risk

Without an emitted event, changes to critical contract parameters happen silently. This:

  • Prevents off-chain tools from tracking state changes

  • Makes it harder for users, maintainers, and auditors to reconstruct historical state

  • May lead to confusion or misinterpretation of claim limit behavior

Likelihood:

  • Medium

    Only callable by onlyOwner, but it can occur every time the function is used. If the owner is governed by DAO or multisig, the lack of an audit trail increases risk


Impact:

  • Poor transparency

Missing historical data

  • Reduces trust in the contract’s operation

  • Weakens incident response and debugging

Proof of Concept

​

Recommended Mitigation

Emit an event each time the claim limit is changed:

+ uint256 previousLimit = dailyClaimLimit;
+ emit DailyClaimedAdjusted(previousLimit, dailyClaimLimit, increaseClaimLimit);
+ event DailyClaimedAdjusted(uint256 previousLimit, uint256 newLimit, bool increased);
Updates

Lead Judging Commences

inallhonesty Lead Judge 17 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.