Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Multiple Vaults Exist Without Restriction

dumbbutt0

Description

  • Normal behavior: Vaults should be managed per user with clear ownership.

  • Issue: Any number of users can create vaults, leading to multiple vaults existing simultaneously and violating assumptions in dApp logic.

// Root cause in the codebase
set_secret(owner, b"owner-secret"); // @> no restriction on vault creation
set_secret(attacker1, b"attacker1-secret");
set_secret(attacker2, b"attacker2-secret");

Risk

Likelihood:

  • Any user can create a vault.

  • Occurs during normal multi-user interaction with the vault module.

Impact:

  • Breaks dApp assumptions of single vault ownership.

  • Attackers could manipulate logic depending on the owner’s vault.

Proof of Concept

#[test(owner = @0xcc, attacker1 = @0x111, attacker2 = @0x222)]
fun test_multiple_vaults(owner: &signer, attacker1: &signer, attacker2: &signer) acquires Vault {
use aptos_framework::account;
use std::debug;
​
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(attacker1));
account::create_account_for_test(signer::address_of(attacker2));
​
set_secret(owner, b"owner-secret");
set_secret(attacker1, b"attacker1-secret");
set_secret(attacker2, b"attacker2-secret");
​
let vault_owner = borrow_global<Vault>(signer::address_of(owner));
let vault_attacker1 = borrow_global<Vault>(signer::address_of(attacker1));
let vault_attacker2 = borrow_global<Vault>(signer::address_of(attacker2));
​
debug::print(&vault_owner.secret);
debug::print(&vault_attacker1.secret);
debug::print(&vault_attacker2.secret);
debug::print(&b"Multiple vaults exist - dangerous assumption for dApps");
}

Recommended Mitigation

- set_secret(attacker1, b"attacker1-secret");
+ if (!exists<Vault>(signer::address_of(attacker1))) {
+ set_secret(attacker1, b"attacker1-secret");
+ }
Updates

Lead Judging Commences

bube Lead Judge 17 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Anyone can call `set_secret` function

In Move for Aptos, the term "owner" refers to a signer, which is a verified account that owns a given resource, has permission to add resources and the ability to grant access or modify digital assets. Following this logic in this contest, the owner is the account that owns `Vault`. This means that anyone has right to call `set_secret` and then to own the `Vault` and to retrieve the secret from the `Vault` in `get_secret` function. Therefore, this group is invalid, because the expected behavior is anyone to call the `set_secret` function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.