Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: medium

Missing events for admin parameter changes in `setStrataxOracle` and `setFlashLoanFee`

Author Revealed upon completion

Root Cause + Impact

setStrataxOracle() (L263) and setFlashLoanFee() (L272) change critical protocol parameters without emitting events. Off-chain monitoring systems cannot detect when these values change.

Description

Admin functions that modify protocol parameters should emit events so off-chain systems (monitoring, frontends, governance dashboards) can track changes.

Both functions silently update state:

// Stratax.sol:263-266
function setStrataxOracle(address _strataxOracle) external onlyOwner {
require(_strataxOracle != address(0), "Invalid oracle address");
strataxOracle = _strataxOracle;
// @> No event emitted
}
​
// Stratax.sol:272-275
function setFlashLoanFee(uint256 _flashLoanFeeBps) external onlyOwner {
require(_flashLoanFeeBps < FLASHLOAN_FEE_PREC, "Fee must be < 100%");
flashLoanFeeBps = _flashLoanFeeBps;
// @> No event emitted
}

Risk

Likelihood: High -- These functions will be called during normal protocol operation.

Impact: Low -- No direct financial loss. Off-chain monitoring is blind to parameter changes. Users cannot verify when the oracle or fee changed without scanning storage diffs.

Proof of Concept

N/A (code inspection).

Recommended Mitigation

Emit events with both old and new values so off-chain systems can track parameter changes:

+ event StrataxOracleUpdated(address indexed oldOracle, address indexed newOracle);
+ event FlashLoanFeeUpdated(uint256 oldFee, uint256 newFee);
​
function setStrataxOracle(address _strataxOracle) external onlyOwner {
require(_strataxOracle != address(0), "Invalid oracle address");
+ emit StrataxOracleUpdated(strataxOracle, _strataxOracle);
strataxOracle = _strataxOracle;
}
​
function setFlashLoanFee(uint256 _flashLoanFeeBps) external onlyOwner {
require(_flashLoanFeeBps < FLASHLOAN_FEE_PREC, "Fee must be < 100%");
+ emit FlashLoanFeeUpdated(flashLoanFeeBps, _flashLoanFeeBps);
flashLoanFeeBps = _flashLoanFeeBps;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!