Submission Details
Impact:
Likelihood:
event in set_secret function does not leak content but indicates that a secret change occurred which is a observable metadata for a attacker
event in set_secret function does not leak content but indicates that a secret change occurred which is a observable metadata for a attacker
Description
set_secret functionemits an event with empty params which does not leak any params but event is publicly visible which indicates an change
public entry fun set_secret(caller:&signer,secret:vector<u8>){
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
@> event::emit(SetNewSecret {});
}
Recommended Mitigation
Event emission is important in contracts, instead of passing the empty params in event pass the params except the secret, can include signer,timestamp,vault_address
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.