Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Event Spam by Attackers

dumbbutt0

Description

  • Normal behavior: Events should correspond to meaningful state changes.

  • Issue: Attackers can repeatedly call set_secret to emit SetNewSecret events, inflating the blockchain event log unnecessarily.

// Root cause in the codebase
set_secret(attacker1, b"attacker1-secret"); // @> emits event repeatedly without checks
set_secret(attacker2, b"attacker2-secret");

Risk

Likelihood:

  • Any user can spam set_secret.

  • Happens when events are relied upon for analytics or game logic.

Impact:

  • Bloats storage and gas usage.

  • Makes it hard to distinguish meaningful events from spam.

Proof of Concept

#[test(owner = @0xcc, attacker1 = @0x111, attacker2 = @0x222)]
fun test_event_spam(owner: &signer, attacker1: &signer, attacker2: &signer) {
use aptos_framework::account;
use std::debug;
​
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(attacker1));
account::create_account_for_test(signer::address_of(attacker2));
​
set_secret(owner, b"owner-secret");
set_secret(attacker1, b"attacker1-secret");
set_secret(attacker2, b"attacker2-secret");
​
debug::print(&string::utf8(b"event spam success!"));
}

Recommended Mitigation

- event::emit(SetNewSecret {});
+ if (!exists<Vault>(signer::address_of(caller))) {
+ event::emit(SetNewSecret {});
+ }
Updates

Lead Judging Commences

bube Lead Judge 17 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.