search

code-423n4 / 2021-11-badgerzaps-findings

0 stars 0 forks source link

Missing events for guardian and governance at `SettToRenIbbtcZap.sol` #9

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0x0x0x

Vulnerability details

Proof of Concept

Such critical changes has to be emitted with events. So that users can get notified about such critical changes. It is important to create a safe environment for users, investors and devs.

Furthermore, I strongly recommend using timelock to create an even safer application and make sure users have no worry about front-running etc.

Tools Used

Manual analysis

tabshaikh commented 2 years ago

which such critical changes?

tabshaikh commented 2 years ago

This has been fixed

GalloDaSballo commented 2 years ago

I completely disagree with the findings, you can track the call of any function by using call listeners, the most common JS libraries such as ethers or web3 allow to literally call: Contract.on(FunctionName) to check for function calls

GalloDaSballo commented 2 years ago

"There should be events" is a best practice, not a security risk

0xleastwood commented 2 years ago

duplicate of #55