Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Insufficient event data field in `SetNewSecret` event emission

soupy

Summary

The SetNewSecret event lacks sufficient detail to reflect its declared abilities. While it includes drop and store abilities, it does not emit any additional data fields to support or describe these operations, limiting its usefulness for transparency, debugging, and off-chain monitoring.

Description

Lack of details in event emission SetNewSecret for clarity especially in off-chain monitoring. The event struct has abilities of drop and store, but does not have further fields under the event struct that demonstrates these declared abilities.

#[event]
struct SetNewSecret has drop, store {
<@@>! // empty fields!!?
}

Risk

Likelihood:

  • This occurs every time a user calls set_secret. Upon completion of the call, the SetNewSecret event is emitted without meaningful or descriptive data.

Impact:

  • Reduces the usefulness of the event for off-chain monitoring, auditing, and debugging. The lack of detail may hinder transparency and make it more difficult to track user actions or system state changes.

Proof of Concept

Manual code review on the following lines of code:

#[event]
struct SetNewSecret has drop, store {
// no details about who set the new secret
}
​
public entry fun set_secret(caller:&signer,secret:vector<u8>){
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
// Although the caller's address can be made available through signer, it is not included in the emitted SetNewSecret event below.
event::emit(SetNewSecret {});
}

Recommended Mitigation

Propose to include caller's address as the event data field in event struct SetNewSecret :

#[event]
struct SetNewSecretEvent has drop, store {
+ account: address,
}
Updates

Lead Judging Commences

bube Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Insufficient Data in `SetNewSecret` event

This is an Informational finding. It has no impact on the security of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.