hats-finance / SeeR-PM-0x899bc13919880db76edf4ccd72bdfa5dfa666fb7

1 stars 0 forks source link

Lack of event emits for critical function #20

Open hats-bug-reporter[bot] opened 1 month ago

hats-bug-reporter[bot] commented 1 month ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0x684e732c9ad1f5a40e473dfb9375ef659a6e3144aa088c2543f18f441bd1c2aa Severity: low

Description: Description

Seer::changeGovernor() changes a critical state variable. The governor is responsible for minting and burning Seer tokens. It's a best practice to emit events in such cases due to the fallowing reasons.

  1. Missing events do not promote transparency and if such changes immediately affect the users’ perception of fairness or trustworthiness, they could exit the protocol causing a reduction in liquidity which could negatively impact protocol TVL and reputation.

  2. Events allow capturing the changed parameters so that off-chain tools/interfaces can register such changes with timelocks that allow users to evaluate them and consider if they would like to engage/exit based on how they perceive the changes as affecting the trustworthiness of the protocol or profitability of the implemented financial services.

  3. The alternative of directly querying on-chain contract state for such changes is not considered practical for most users/usages.

Attachments

  1. Proof of Concept (PoC) File
    function changeGovernor(address _governor) external onlyGovernor {
        governor = _governor;//@audit-issue lack of event emition
    }
  1. Revised Code File (Optional)

Emit an event after the governor has changed


    event GovernorChanged(address newGovernor, address oldGovernor);

    function changeGovernor(address _governor) external onlyGovernor {
        governor = _governor;

        emit GovernorChanged(_governor, msg.sender);
    }
clesaege commented 1 month ago

Out of scope and not an issue.