Submission Details
Impact:
Likelihood:
Empty Event Payload
Description
Events should include enough data for off-chain indexers to correlate actions.
SetNewSecret event has no fields, So it's mpossible to know who updated or correlate to a specific state change.
// move
#[event]
struct SetNewSecret has drop, store { } // no fields
Risk
Likelihood:
Always every emission contains no useful context.
Impact:
Poor observability for wallets/indexers, harder debugging and analytics.
Proof of Concept
All emitted events are identical; cannot attribute to @owner or a transaction specific value.
Recommended Mitigation
- #[event]
- struct SetNewSecret has drop, store { }
+ #[event]
+ struct SetNewSecret has drop, store {
+ actor: address,
+ // optionally: version: u64, timestamp: u64, etc.
+ }
...
- event::emit(SetNewSecret {});
+ event::emit(SetNewSecret { actor: signer::address_of(caller) });
Updates
Lead Judging Commences
bube 4 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Insufficient Data in `SetNewSecret` event
This is an Informational finding. It has no impact on the security of the protocol.
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.