Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

[L-1]: Uninformative Event Hinders Off-Chain Monitoring

cosminmarian53

[L-1]: Uninformative Event Hinders Off-Chain Monitoring

Description

Events emitted by a contract should contain relevant data to allow off-chain services to monitor on-chain activity.

The SetNewSecret event is an empty struct. When emitted, it signals that an update happened but provides no context, such as who performed the action or when it occurred.

#[event]
struct SetNewSecret has drop, store {
// Flaw: No fields to provide context.
}

Risk

Likelihood: High

  • This uninformative event is emitted every time set_secret is successfully called.

Impact: Low

  • Reduced Auditability: It is difficult for off-chain tools, block explorers, or security dashboards to track the vault's history.

  • Integration Difficulty: Applications that want to react to a secret being updated cannot easily use this event because it lacks identifying information.

Proof of Concept

The issue is self-evident from the code. When event::emit(SetNewSecret {}) is executed, an event with an empty data payload is logged. An off-chain indexer parsing this event cannot determine who the owner was or get a timestamp without parsing the raw transaction details, defeating the purpose of events.

Recommended Mitigation

Add relevant fields to the event struct and populate them when the event is emitted.

+ use aptos_framework::timestamp;
​
#[event]
struct SetNewSecret has drop, store {
+ owner_address: address,
+ update_timestamp_secs: u64
}
​
// When emitting in set_secret:
- event::emit(SetNewSecret {});
+ event::emit(SetNewSecret {
+ owner_address: signer::address_of(caller),
+ update_timestamp_secs: timestamp::now_seconds()
+ });
Updates

Lead Judging Commences

bube Lead Judge 18 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Insufficient Data in `SetNewSecret` event

This is an Informational finding. It has no impact on the security of the protocol.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.