Skip to content

Several privileged mutations emit no on-chain event, breaking the audit trail #917

Description

@Ejirowebfi

🔴 Critical · contracts/token-factory/src/lib.rs:696-732,762-787,821-849

Description

Cross-referencing every state-mutating function against env.events().publish(...) call sites shows set_burn_enabled, set_fee_split, upgrade, and migrate perform privileged state changes with no corresponding event. For a contract whose entire off-chain observability story (the frontend's Transaction History view, any future indexer per issue #35, external monitoring) is built on parsing emitted events, this means: a token's burn-ability being silently toggled off, a fee split being silently reconfigured to route funds to new recipients, and the factory's executable code being silently upgraded are all invisible to anyone watching only the event stream — they'd need to poll get_state()/get_fee_split()/token WASM hashes directly and diff against a prior snapshot to notice.

Tasks

  • Add an event emission to set_burn_enabled (e.g. (factory, burn_flag), (token_address, enabled)).
  • Add an event emission to set_fee_split (e.g. (factory, split), (admin,) — consider whether emitting the full map is desirable/affordable given issue Expand Contract Test Coverage #6's size concerns, or just a change marker prompting off-chain code to re-fetch via get_fee_split).
  • Add an event emission to upgrade (e.g. (factory, upgraded), (admin, new_wasm_hash)) — this is arguably the single most security-critical operation in the entire contract and currently the quietest.
  • Add an event emission to migrate (e.g. (factory, migrated), (from_version, to_version)).
  • Update docs/contract-abi.md's Events table to include all four new events.
  • Update the frontend's event parser (frontend/src/services/stellar-impl.ts) and Transaction History UI to recognize and render the new event types.

Acceptance Criteria

  • Every function that mutates FactoryState or per-token state emits a distinguishable event, verified by a test that asserts on env.events().all() (or the SDK's equivalent test-events accessor) after each mutating call.
  • docs/contract-abi.md and the frontend event parser are updated in the same change, not left to drift.

Metadata

Metadata

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions