Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Empty Events Provide No Information for Off-Chain Monitoring

r4y4n3

Root + Impact

Description

Normal Behavior

Events should provide meaningful information to enable off-chain applications to monitor contract activity, track user actions, and build comprehensive audit trails.

Issue

The SetNewSecret event contains no fields, making it completely useless for off-chain monitoring. When multiple users set secrets, there's no way to distinguish between events, identify which user performed the action, or correlate events with specific operations.

#[event]
struct SetNewSecret has drop, store {
// ❌ No fields - completely empty event
}
​
public entry fun set_secret(caller:&signer,secret:vector<u8>){
// ...
event::emit(SetNewSecret {}); // @> Emits empty event
}

Risk

Likelihood:

  • Every set_secret call emits an empty event

  • Off-chain applications cannot distinguish between events

  • 100% of events provide no useful information

Impact:

  • No monitoring capability: Off-chain apps cannot track secret operations

  • Poor audit trails: Cannot correlate events to specific users or actions

  • Development friction: Developers cannot build meaningful integrations

  • Debugging difficulty: No event-based debugging or analysis possible

  • Missing analytics: Cannot track usage patterns or user behavior

Proof of Concept

The following test demonstrates the empty event vulnerability:

#[test(user1 = @0x777, user2 = @0x778, user3 = @0x779)]
fun test_empty_event_vulnerability(user1: &signer, user2: &signer, user3: &signer) {
// Multiple users set secrets
set_secret(user1, b"user1_secret");
set_secret(user2, b"user2_secret");
set_secret(user3, b"user3_secret");
// 3 SetNewSecret events were emitted
// But they contain ZERO information:
// - No owner address
// - No secret hash/digest
// - No timestamp
// - No metadata
}

Recommended Mitigation

Add meaningful fields to the event:

#[event]
struct SetNewSecret has drop, store {
+ owner: address, // Who set the secret
+ secret_hash: vector<u8>, // Hash of secret for verification
+ timestamp: u64, // When the secret was set
+ size: u64, // Size of the secret data
}
​
public entry fun set_secret(caller:&signer,secret:vector<u8>){
+ use aptos_framework::timestamp;
+ use aptos_std::crypto_algebra;
+
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
- event::emit(SetNewSecret {});
+ event::emit(SetNewSecret {
+ owner: signer::address_of(caller),
+ secret_hash: crypto_algebra::sha3_256(secret),
+ timestamp: timestamp::now_seconds(),
+ size: vector::length(&secret),
+ });
}
Updates

Lead Judging Commences

bube Lead Judge 14 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Insufficient Data in `SetNewSecret` event

This is an Informational finding. It has no impact on the security of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.