F-2025-0015·missing-events

Missing events for important state changes

Acknowledgedvaultetfstrategyd2-contracts
TL;DR

Several state-changing functions on Strategy and VaultV3 do not emit events, leaving indexers, dashboards, and on-chain monitoring without a record of when admin actions occurred or who triggered them.

Severity
LOW
Impact
LOW
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The following calls lack events emitted even though they change important states inside the contracts:

  • Strategy::claim
  • Strategy::setFrozen
  • Strategy::setSelector
  • VaultV3::emergencyFreeze

Without events, off-chain consumers (indexers, monitoring tools, dashboards, automated alerting) have no efficient way to detect when these actions are taken or to attribute them to a specific actor and transaction. This degrades both transparency and incident response capability.

03Section · Recommendation

Recommendation

Consider adding events to be emitted in the above calls. This provides a clear on-chain record of when and by whom the strategy was claimed, frozen, or had its selector mapping changed, improving transparency and auditability.

04Section · Resolution

Resolution

D2: Ignored "Missing events for important state changes" as we will remove those calls shortly.

Cyfrin: Acknowledged.

F-2025-0015