Root + Impact

Description

• * The `selectWinner()` function performs critical state changes including selecting a winner, minting an NFT, distributing prize funds, and resetting the raffle, but does not emit any event to notify off-chain systems of these changes.

  * Events are essential for off-chain monitoring, frontend updates, and building integrations. Without an event, applications must poll the contract or rely on transaction logs, which is inefficient and unreliable.

  ```solidity:125:154:src/PuppyRaffle.sol

  function selectWinner() external {

  require(block.timestamp >= raffleStartTime + raffleDuration, "PuppyRaffle: Raffle not over");

  require(players.length >= 4, "PuppyRaffle: Need at least 4 players");

  uint256 winnerIndex =

  uint256(keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty))) % players.length;

  address winner = players[winnerIndex];

  uint256 totalAmountCollected = players.length * entranceFee;

  uint256 prizePool = (totalAmountCollected * 80) / 100;

  uint256 fee = (totalAmountCollected * 20) / 100;

  totalFees = totalFees + uint64(fee);

  uint256 tokenId = totalSupply();

  // We use a different RNG calculate from the winnerIndex to determine rarity

  uint256 rarity = uint256(keccak256(abi.encodePacked(msg.sender, block.difficulty))) % 100;

  if (rarity <= COMMON_RARITY) {

  tokenIdToRarity[tokenId] = COMMON_RARITY;

  } else if (rarity <= COMMON_RARITY + RARE_RARITY) {

  tokenIdToRarity[tokenId] = RARE_RARITY;

  } else {

  tokenIdToRarity[tokenId] = LEGENDARY_RARITY;

  }

  delete players;

  raffleStartTime = block.timestamp;

  previousWinner = winner;

  (bool success,) = winner.call{value: prizePool}("");

  require(success, "PuppyRaffle: Failed to send prize pool to winner");

  _safeMint(winner, tokenId);

  }

  ```

Risk

Likelihood:

• * This occurs on every call to `selectWinner()` - the function always completes without emitting an event

  * Frontend applications and monitoring systems need to track winner selections

  * Integration with other contracts or services requires event-based notifications

Impact:

• * Reduced observability - off-chain systems cannot easily track raffle outcomes

  * Poor user experience - frontends cannot react in real-time to winner selections

  * Harder to build integrations and analytics

  * Difficult to audit raffle history without parsing transaction logs

Proof of Concept

Recommended Mitigation