Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: high

Missing Event Emissions for Critical State Changes

Author Revealed upon completion

Root + Impact

Description

  • In Stratax.sol, Several critical state-changing functions don't emit events, making it difficult to track important protocol changes off-chain. Functions like setStrataxOracle, setFlashLoanFee, and recoverTokens modify critical protocol parameters without event emissions.

function setStrataxOracle(address _strataxOracle) external onlyOwner {
require(_strataxOracle != address(0), "Invalid oracle address");
strataxOracle = _strataxOracle;
// @>
}
​
function setFlashLoanFee(uint256 _flashLoanFeeBps) external onlyOwner {
require(_flashLoanFeeBps < FLASHLOAN_FEE_PREC, "Fee must be < 100%");
flashLoanFeeBps = _flashLoanFeeBps;
// @>
}
​
function recoverTokens(address _token, uint256 _amount) external onlyOwner {
IERC20(_token).transfer(owner, _amount);
// @>
}

Risk

Impact:

  • Lack of events makes it impossible to track critical protocol changes, monitor for suspicious activity, or build accurate off-chain monitoring systems. This reduces transparency and makes it harder to detect potential attacks or misuse.

Proof of Concept

no need

Recommended Mitigation

+event OracleUpdated(address indexed oldOracle, address indexed newOracle);
+event FlashLoanFeeUpdated(uint256 oldFee, uint256 newFee);
+event TokensRecovered(address indexed token, uint256 amount, address indexed recipient, uint256 indexed _time);
​
function setStrataxOracle(address _strataxOracle) external onlyOwner {
require(_strataxOracle != address(0), "Invalid oracle address");
address oldOracle = strataxOracle;
strataxOracle = _strataxOracle;
+ emit OracleUpdated(oldOracle, _strataxOracle);
}
​
function setFlashLoanFee(uint256 _flashLoanFeeBps) external onlyOwner {
require(_flashLoanFeeBps < FLASHLOAN_FEE_PREC, "Fee must be < 100%");
uint256 oldFee = flashLoanFeeBps;
flashLoanFeeBps = _flashLoanFeeBps;
+ emit FlashLoanFeeUpdated(oldFee, _flashLoanFeeBps);
}
​
function recoverTokens(address _token, uint256 _amount) external onlyOwner {
IERC20(_token).transfer(owner, _amount);
+ emit TokensRecovered(_token, _amount, owner, block.timestamp);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!