Submission Details
Severity:
No access control for get_secret - Anyone can get the owner's secret
There is no access control for get_secret, so anyone can get the owner's secret.
Description
-
Only the owner can get their secrets.
-
But there is no access control for
get_secret,and there is only an address check. So anyone can get the secret by passing the owner's address as an argument.
#[view]
public fun get_secret (caller: address):String acquires Vault{
// Only check the caller parameter, not passing signer.
@> assert! (caller == @owner,NOT_OWNER);
let vault = borrow_global<Vault >(@owner);
vault.secret
}
Risk
Likelihood:
When anyone call
get_secretwith the owner's address, it happens.
Impact:
Anyone can get the owner's secret, and it breaks the protocol.
Proof of Concept
Owner sets their secret.
User calls
get_secretwith owner's addressUser gets the secret.
#[test(owner = @0xcc, user = @0x123)]
fun test_anyone_can_read_owners_secret(owner: &signer, user: &signer) acquires Vault{
use aptos_framework::account;
// Set up test environment
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(user));
let secret = b"i'm a secret";
set_secret(owner,secret);
// Get the owner's address
let owner_address = signer::address_of(owner);
// Verify the secret was added
let secret_from_owner = get_secret(owner_address);
assert!(secret_from_owner == string::utf8(secret), 4);
debug::print(&string::utf8(b"Anyone can read owner's address!"));
}
Recommended Mitigation
Use signer instead of just address.
#[view]
-public fun get_secret (caller: address):String acquires Vault{
+public fun get_secret(caller: &singer): String acquires Vault{
- assert! (caller == @owner,NOT_OWNER);
+ assert!(signer::address_of(caller) == @owner, NOT_OWNER);
let vault = borrow_global<Vault >(@owner);
vault.secret
}
Updates
Lead Judging Commences
bube 16 days ago
Submission Judgement Published Assigned finding tags:
Lack of signer check in `get_secret`
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.