code-423n4 / 2021-11-badgerzaps-findings

0 stars 0 forks source link

`Zap.sol` no events for governance #17

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0x0x0x

Vulnerability details

Proof of Concept

In Zap.sol, governance have the access control. There is no event on change of governance, where governance can allow or block any address from the contract. Governance changes and functions should be emitted to inform users about changes. Furthermore, multi-sign, Timelock etc. are highly recommended.

Tools Used

Manual analysis

GalloDaSballo commented 2 years ago

Disagree with the finding, any developer can just listen to the functionCall, it's even a feature of theGraph, having an event doesn't increase visibility of these changes

Having an event is a best practice, as such I would downgrade the severity

0xleastwood commented 2 years ago

duplicate of #55