Usage of events

In the version under review, the contract emits two possible events.

event BillsPaid(address indexed payer, uint256 totalPayments);
event Refund(address indexed recipient, uint256 amount);

These events are not currently used by any off-chain component. Additionally, the BillsPaid event only contains the number of payments performed and the payer, but it does not contain any information about the individual payments made (asset, amount, and recipient).

We also note that the BillsPaid event is emitted even if the payBills function is invoked with an empty payments array. While this condition is easily recognizable by whoever parses the event, we advise to document this behavior to reduce the risk of a user not considering this edge case.

Remediation

This discussion item was addressed in commit by emitting an event for each payment that contains the payer, recipient, asset address, and amount.