Submission Details
Impact:
Likelihood:
[L-2] Missing events hamper contract's auditability and limit traceability of on-chain actions
[L-2] Missing events hamper contract's auditability and limit traceability of on-chain actions
Description
-
Expected bahaviour State changes should be followed by event emissions so that they can be tracked by indexers.
-
Problematic bahaviour Missing events from functions where state is altered reduce the ability to monitor and audit the contract's actions.
function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
.
.
_burn(msg.sender, amountToBurn);
@> // emit event here
}
function adjustDailyClaimLimit(uint256 by, bool increaseClaimLimit) public onlyOwner {
if (increaseClaimLimit) {
dailyClaimLimit += by;
@> // emit event here
} else {
.
.
dailyClaimLimit -= by;
@> // emit event here
}
}
.
.
if (currentDay > lastDripDay) {
lastDripDay = currentDay;
dailyDrips = 0;
@> // emmit event here
}
.
.
Risk
Likelihood: High
Events are not emitted in many cases when core contract methods are called.
Impact: Low
The omission of events hinders the ability of indexers to track faucet auctions and state changes.
Proof of Concept
A PoC is not necessary in this case.
Recommended Mitigation
Follow best practices by emitting events after all state changes.
event TokensBurned(uint256 amount);
event DailyLimitAdjusted(uint256 by, bool increaseClaimLimit);
event DailyDripsReset();
function burnFaucetTokens(uint256 amountToBurn) public onlyOwner {
.
.
_burn(msg.sender, amountToBurn);
+ emit TokensBurned(amount);
}
function adjustDailyClaimLimit(uint256 by, bool increaseClaimLimit) public onlyOwner {
if (increaseClaimLimit) {
dailyClaimLimit += by;
+ emit DailyLimitAdjusted(by, increaseClaimLimit);
} else {
.
.
dailyClaimLimit -= by;
+ emit DailyLimitAdjusted(by, increaseClaimLimit);
}
}
.
.
if (currentDay > lastDripDay) {
lastDripDay = currentDay;
dailyDrips = 0;
+ emit DailyDripsReset();
}
.
.
Rewards breakdown
nSLOC
157This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.