Unauthorized Secret Retrieval in SecretVault Allows Any User to Access Sensitive Data

Description

• The contract fails to enforce access control on the get_secret() (or equivalent retrieval) function.

• This means any user can read the stored secret directly from the contract, defeating the purpose of storing it securely.

Risk : High

Likelihood:

• This will happen every time when attacker will misuse it

Impact: High

• Complete loss of confidentiality for the stored secret.

Owner’s private data becomes publicly accessible to all blockchain participants.Users lose trust in the application, as the core promise (“only the owner can access the secret”) is broken.

Proof of Concept

1. Alice stores her secret in the contract using store_secret().

2. Mallory (attacker) calls:

let stolen_secret = SecretVault::Vault::get_secret(@alice);

3. Mallory now has full access to Alice’s secret.

Recommended Mitigation