Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Any User can write a Vault to their own Address Causing Spam state.

mentemdeus

Description

Only the single configured owner should be able to store a secret and later retrieve it. No one else should be able to store or read any secret.

set_secret allows any signer to publish a Vault under their own address, but get_secret only reads from the hardcoded @owner. Non-owner callers can create vaults that they can never read, resulting in unexpected state and broken UX/spec.

// move
public entry fun set_secret(caller: &signer, secret: vector<u8>) {
let secret_vault = Vault{ secret: string::utf8(secret) };
@> move_to(caller, secret_vault); // Stores under the caller's address (anyone)
event::emit(SetNewSecret {});
}
​
​

Risk

Likelihood:

Happens whenever any non-owner calls set_secret (common user behavior).

Happens in production because nothing prevents non-owner calls.

Impact:

Non-owners create unreadable vaults fundamental loss of functionality.

Violates contract purpose, non-owners can use the app (even if unreadable afterward).

Proof of Concept

// move (unit test sketch)
#[test(owner = @0xcc, user = @0x123)]
fun poc_orphaned_vault(owner: &signer, user: &signer) acquires Vault {
use aptos_framework::account;
​
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(user));
​
// Non-owner sets a secret successfully (publishes under @0x123)
let secret = b"i am stuck";
set_secret(user, secret);
​
}

Recommended Mitigation

Consider making this changes

public entry fun set_secret(caller: &signer, secret: vector<u8>) {
+ // Restrict to the single configured owner
+ assert!(signer::address_of(caller) == @owner, NOT_OWNER);
let secret_vault = Vault{ secret: string::utf8(secret) };
move_to(caller, secret_vault);
event::emit(SetNewSecret {});
}
Updates

Lead Judging Commences

bube Lead Judge 17 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Anyone can call `set_secret` function

In Move for Aptos, the term "owner" refers to a signer, which is a verified account that owns a given resource, has permission to add resources and the ability to grant access or modify digital assets. Following this logic in this contest, the owner is the account that owns `Vault`. This means that anyone has right to call `set_secret` and then to own the `Vault` and to retrieve the secret from the `Vault` in `get_secret` function. Therefore, this group is invalid, because the expected behavior is anyone to call the `set_secret` function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.