No Event Emitted on Minting

[code423n4]

Handle

TimmyToes

Vulnerability details

Impact

Any system integrating with yAxis, reporting on yAxis, monitoring yAxis or providing services for yAxis will find it significantly harder to do so and may take decisions based on mistaken data.

Proof of Concept

All other functions built for users to interact with the system that involve changes to asset status are emitting events:
https://github.com/code-423n4/2021-11-yaxis/blob/146febcb61ae7fe20b0920849c4f4bbe111c6ba7/contracts/v3/alchemix/Alchemist.sol#L86-L112
Mint does not:
https://github.com/code-423n4/2021-11-yaxis/blob/146febcb61ae7fe20b0920849c4f4bbe111c6ba7/contracts/v3/alchemix/Alchemist.sol#L611-L645

Recommended Mitigation Steps

Create an event TokensMinted and call it in mint()
Also, provide enough info to the event that monitoring systems can tell whether the tokens were minted against credit or debt.

[Xuefeng-Zhu]

I think mint event will be emitted by ERC20

[0xleastwood]

Correct, ERC20 standard contact will emit a Transfer event upon minting xTokens. However, it may be useful to also emit a relevant TokensMinted event that is unique to the Alchemist contract.

[0xleastwood]

Will mark as non-critical as there is no direct security risk.