Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Empty Event reduces monitoring and auditability

yo4nn

Empty Event reduces monitoring and auditability

Description

  • Normally, events are emitted with meaningful fields so that off-chain indexers and applications can react to changes in the contract state (e.g., logging who change the password or when it was updated).

  • In this contract, the SetNewSecret event is declared without any fields. This makes it impossible for off-chain consumers to identify useful information (such as the sender, the secret identifier, or a timestamp). As a result, the event provides little to no value.

// Root cause in the codebase with @> marks to highlight the relevant section
#[event]
@> struct SetNewSecret has drop, store {
}

Risk

Likelihood: High

  • This will always occur since the event is defined as empty.

Impact: Low

  • The event is emitted but does not provide any actionable information.

  • Off-chain systems cannot distinguish between different secret updates or track meaningful changes.

Proof of Concept

  1. Emit an event by calling set_secret

  2. Count the event emitted with event::emitted_events<SetNewSecret>()

  3. Show that is impossible to access field of event because it is empty

#[test(owner = @0xcc, user = @0x123)]
fun test_empty_event(owner: &signer, user: &signer) {
use aptos_framework::account;
use aptos_framework::event;
use std::string;
use std::vector;
use std::debug;
// Set up test environment
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(user));
// Define a secret and set it (this should emit the SetNewSecret event)
let secret = b"i'm a secret";
set_secret(owner, secret);
// Read emitted events
let events = event::emitted_events<SetNewSecret>();
​
// Check if at least one event was emitted
assert!(vector::length(&events) > 0, 1);
​
// Debug print the event to show it's empty (no fields)
let count = vector::length(&events);
debug::print(&string::utf8(b"Empty event data:"));
debug::print(&count);
// NOTE: we cannot access any field because the event struct has none
debug::print(&string::utf8(b"Event struct has 0 fields -> empty event"));
}

Recommended Mitigation

It is recommended to include relevant fields (e.g., owner and timestamp) in the event so that off-chain applications can properly track and audit contract activity.

​
- struct SetNewSecret has drop, store {
- }
+ struct SetNewSecret has drop, store {
+ owner: address,
+ timestamp: u64,
+ }
Updates

Lead Judging Commences

bube Lead Judge 17 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Insufficient Data in `SetNewSecret` event

This is an Informational finding. It has no impact on the security of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.