Expert Wool Armadillo - Missing events/timelocks for admin only functions that change critical parameters

[sherlock-admin2]

Expert Wool Armadillo

Medium

Missing events/timelocks for admin only functions that change critical parameters

Summary

Owner/admin only functions that change critical parameters should emit events and have timelocks. Events allow capturing the changed parameters so that off-chain tools/interfaces can register such changes with timelocks that allow users to evaluate them and consider if they would like to engage/exit based on how they perceive the changes as affecting the trustworthiness of the protocol or profitability of the implemented financial services. The alternative of directly querying on-chain contract state for such changes is not considered practical for most users/usages.

Root Cause

Missing events and timelocks do not promote transparency and if such changes immediately affect users’ perception of fairness or trustworthiness, they could exit the protocol.

• In LenderCommitmentGroup_Smart.sol:355-361
  https://github.com/sherlock-audit/2024-11-teller-finance-update/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L355-L361
  This function implement minimum requirement to limit protocolOwner action but no event is emited
• In LenderCommitmentGroup_Smart.sol:368-372
  https://github.com/sherlock-audit/2024-11-teller-finance-update/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L368-L372
  This function does not implement minimum requirement/timelock to limit owner action and no event is emited
  All of this are critical modifications and should not be done without restrictions.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

Recommend adding events to all owner/admin functions that change critical parameters. Add timelocks to introduce time delays for critical parameter changes that significantly impact the protocol users.