MyCut

AI First Flight #8
Beginner FriendlyFoundry
EXP
View results
Submission Details
Severity: low
Valid

# There is no event for creating a new contract `Pot`.

There is no event for creating a new contract Pot.

Description

Every time a new contract is created in ContestManager::createContest

it does not trigger a new contract creation event, which would be difficult to track.

function createContest(
address[] memory players,
uint256[] memory rewards,
IERC20 token,
uint256 totalRewards
) public onlyOwner returns (address) {
// Create a new Pot contract
Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
return address(pot);
}

// Root cause in the codebase with @> marks to highlight the relevant sectionfunction createContest(
address[] memory players,
uint256[] memory rewards,
IERC20 token,
uint256 totalRewards
) public onlyOwner returns (address) {
// Create a new Pot contract
@> Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
return address(pot);
}

The event will help track the creation of new pools and access them, making it easier for the frontend/backend.

Recommended Mitigation

Add a new event and emit it when created.

+ event NewPot(address indexed pot, uint256 totalRewards, uint256 playerCount, address indexed token);
function createContest(
address[] memory players,
uint256[] memory rewards,
IERC20 token,
uint256 totalRewards
) public onlyOwner returns (address) {
// Create a new Pot contract
Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
+ emit NewPot(address(pot), totalRewards, players.length, address(token));
return address(pot);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

[L-02] Lack of events which reduces transparency and difficulty in monitoring

**Description** The `ContestManager` contract lacks event emissions for critical actions such as creating, funding, and closing contests. Events are crucial in Solidity contracts for logging important actions, as they provide an immutable record on the blockchain that can be indexed and queried by off-chain applications. Without these events, tracking the state and history of the contract becomes difficult, which can hinder monitoring, debugging, and auditing efforts. **Impact** - **Visibility**: Without events, external parties (such as users or monitoring systems) cannot easily track when contests are created, funded, or closed. This lack of visibility can lead to difficulties in verifying the correct operation of the contract. - **Debugging**: Developers and auditors will find it more challenging to diagnose issues or verify contract behavior without event logs. In the event of a bug or issue, the absence of events makes it harder to trace the sequence of actions leading up to the problem. - **Transparency**: Participants in the contests might not have a clear understanding of the state of the contract, which could lead to mistrust or uncertainty. **Proof of Concepts** The following functions in the `ContestManager` contract are identified as lacking event emissions: - `createContest` - `fundContest` - `closeContest` For example, in the `createContest` function: ```solidity function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) public onlyOwner returns (address) { Pot pot = new Pot(players, rewards, token, totalRewards); contests.push(address(pot)); contestToTotalRewards[address(pot)] = totalRewards; // No event emitted to signal that a new contest has been created. return address(pot); } ``` **Recommended Mitigation:** Add event declarations and emit statements in the contract to log significant actions. ```solidity event ContestCreated(address indexed contestAddress, uint256 totalRewards); event ContestFunded(address indexed contestAddress, uint256 amount); event ContestClosed(address indexed contestAddress); ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!