Root + Impact

Description

• The `matchRewards()` function performs critical operations (deploying a multisig wallet and transferring funds) but does not emit any events. This makes it difficult to track multisig deployments and fund transfers off-chain, reducing transparency and making it harder to monitor protocol activity.

  ```solidity

  function matchRewards(address from, address to) internal {

  // ... calculations ...

  // @> No event emitted for multisig deployment

  MultiSigWallet multiSigWallet = new MultiSigWallet(from, to);

  // @> No event emitted for fund transfer

  (bool success,) = payable(address(multiSigWallet)).call{value: rewards}("");

  require(success, "Transfer failed");

  }

  ```

  ### Root Cause

  The function is internal and doesn't emit events for the multisig deployment or the fund transfer, relying only on the `Matched` event from the calling function.

Risk

Likelihood:

• * This occurs on every match - events are always missing

  * Off-chain systems cannot track multisig deployments

  * No way to monitor fund transfers to multisig wallets

Impact:

• * Reduced transparency and observability

  * Difficult to track multisig wallet addresses off-chain

  * Harder to audit and monitor protocol activity

  * Frontend applications cannot easily display multisig information

Proof of Concept

Recommended Mitigation