Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Event Emission Without Contextual Data in set_secret Function

codeaudit0x1

Root + Impact

Description

  • Normal behavior:
    In blockchain smart contracts, events are typically emitted with enough contextual data (e.g., sender address, affected values, timestamps, transaction IDs) so that off-chain systems and auditors can track state changes and identify who performed the action.

  • Specific issue:
    In set_secret, the SetNewSecret event is emitted without any payload data. This makes the event useless for auditing because it contains no details about the caller or the secret change.

public entry fun set_secret(caller: &signer, secret: vector<u8>) {
let secret_vault = Vault { secret: string::utf8(secret) };
move_to(caller, secret_vault);
event::emit(SetNewSecret {}); // @> Event has no fields, so emitted data is empty
}

Risk

Likelihood:

  • Every time set_secret is called, this empty event will be emitted.

  • Indexers and off-chain log parsers will not be able to determine who changed the secret.

Impact:

  • Audit failure – No way to verify which address performed the action from event logs alone.

  • Forensics gap – In case of a security incident, event logs won’t be sufficient for investigation.

Recommended Mitigation

  • Caller’s address is explicitly stored in the event.

  • The secret’s hash (instead of plaintext) allows off-chain verifiers to check integrity without exposing sensitive data.

- #[event]
- struct SetNewSecret has drop, store {}
​
+ #[event]
+ struct SetNewSecret has drop, store {
+ account: address,
+ secret_hash: vector<u8>
+ }
​
- event::emit(SetNewSecret {});
+ event::emit(SetNewSecret {
+ account: signer::address_of(caller),
+ secret_hash: aptos_hash::blake2b_256(secret)
+ });
Updates

Lead Judging Commences

bube Lead Judge 15 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Insufficient Data in `SetNewSecret` event

This is an Informational finding. It has no impact on the security of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.