NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Important State Changes Occur Without Corresponding Events

Author Revealed upon completion

Important State Changes Occur Without Corresponding Events

Description

Several functions update important protocol state without emitting an event, including revealCollection(), whitelistWallet(), removeWhitelistedWallet(), and collectUsdcFromSelling(). This makes offchain indexing, monitoring, and incident investigation harder than necessary.

function revealCollection() external onlyOwner {
isCollectionRevealed = true;
}
​
function whitelistWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = true;
}
​
function removeWhitelistedWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = false;
}

Risk

Likelihood:

  • The issue appears whenever these state-changing functions are used.

Impact:

  • Offchain systems cannot reliably track important protocol state transitions from logs alone.

Proof of Concept

The issue is visible directly in the listed functions: state is updated, but no event is emitted for indexers or monitoring systems.

Recommended Mitigation

Emit dedicated events for important admin and accounting state changes.

+event CollectionRevealed();
+event WalletWhitelisted(address indexed wallet);
+event WalletRemovedFromWhitelist(address indexed wallet);
​
function revealCollection() external onlyOwner {
isCollectionRevealed = true;
+ emit CollectionRevealed();
}
function whitelistWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = true;
+ emit WalletWhitelisted(_wallet);
}
function removeWhitelistedWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = false;
+ emit WalletRemovedFromWhitelist(_wallet);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!