NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Important State Changes Occur Without Corresponding Events

0xzeusng

Important State Changes Occur Without Corresponding Events

Description

Several functions update important protocol state without emitting an event, including revealCollection(), whitelistWallet(), removeWhitelistedWallet(), and collectUsdcFromSelling(). This makes offchain indexing, monitoring, and incident investigation harder than necessary.

function revealCollection() external onlyOwner {
isCollectionRevealed = true;
}
​
function whitelistWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = true;
}
​
function removeWhitelistedWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = false;
}

Risk

Likelihood:

  • The issue appears whenever these state-changing functions are used.

Impact:

  • Offchain systems cannot reliably track important protocol state transitions from logs alone.

Proof of Concept

The issue is visible directly in the listed functions: state is updated, but no event is emitted for indexers or monitoring systems.

Recommended Mitigation

Emit dedicated events for important admin and accounting state changes.

+event CollectionRevealed();
+event WalletWhitelisted(address indexed wallet);
+event WalletRemovedFromWhitelist(address indexed wallet);
​
function revealCollection() external onlyOwner {
isCollectionRevealed = true;
+ emit CollectionRevealed();
}
function whitelistWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = true;
+ emit WalletWhitelisted(_wallet);
}
function removeWhitelistedWallet(address _wallet) external onlyOwner {
whitelistedUsers[_wallet] = false;
+ emit WalletRemovedFromWhitelist(_wallet);
}
Updates

Lead Judging Commences

rubik0n Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

info

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!