A privileged state change (owner, fee, oracle, pause, upgrade) emits no event. Off-chain monitors, block explorers, and users cannot detect the change in real time, delaying incident response to a malicious or mistaken admin action.
// owner silently calls setOracle(evilOracle) with no event. // nothing alerts users; the next deposits are priced by the attacker // before anyone notices.
event FeeUpdated(uint256 oldFee, uint256 newFee);
function setFee(uint256 f) external onlyOwner { emit FeeUpdated(feeBps, f); feeBps = f; }
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0141 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.