Secret Vault
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Unauthorized set, anyone can set a secret to other owner vault

alexscherbatyuk

Root + Impact

Description

  • The normal behavior is that only the owner can set a secret in their vault.

  • Currently, anyone can create a vault and set a secret in another person’s vault.

public entry fun set_secret(caller:&signer,secret:vector<u8>){
@> ...
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
event::emit(SetNewSecret {});
}

Risk

Likelihood: High

  • The path is straightforward; anyone can call set_secret.

  • Does not require the caller to have a vault or any access level.

Impact: Low

  • Doesn’t affect the owner’s vault; minor ecosystem impact.

  • Minor ecosystem impact; violates contract specification.

Proof of Concept

Any user (attacker) can set their own secret in another owner's vault, which violates the primary directive that only the owner can set a secret.

#[test(owner = @0xcc, attacker = @0x456)]
public fun test_attacker_can_only_access_own_secret(owner: &signer, attacker: &signer) {
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(attacker));
let owner_secret = b"owner secret";
let attacker_secret = b"attacker secret";
vault::set_secret(owner, owner_secret);
vault::set_secret(attacker, attacker_secret);
assert!(true, 101);
}

Recommended Mitigation

Enforce signer-based authentication for secrets to be set only by actual owner of the vault.

public entry fun set_secret(caller:&signer,secret:vector<u8>){
+ assert!(signer::address_of(caller) == @owner, NOT_OWNER);
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
event::emit(SetNewSecret {});
}
Updates

Lead Judging Commences

bube Lead Judge 11 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Anyone can call `set_secret` function

In Move for Aptos, the term "owner" refers to a signer, which is a verified account that owns a given resource, has permission to add resources and the ability to grant access or modify digital assets. Following this logic in this contest, the owner is the account that owns `Vault`. This means that anyone has right to call `set_secret` and then to own the `Vault` and to retrieve the secret from the `Vault` in `get_secret` function. Therefore, this group is invalid, because the expected behavior is anyone to call the `set_secret` function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.