Submission Details
Severity:
Malicious user can retrieve the secret
Root + Impact
get_secret` does not sufficiently validate the caller is a signer
Description
get_secret can be called by anyone because it does not ensure that the caller signs the transaction
@> public fun get_secret (caller: address):String acquires Vault{
assert! (caller == @owner,NOT_OWNER);
Risk
Likelihood:
High: Anyone can call this
Impact:
High: Exposed keys
Recommended Mitigation
Modify the get_secret to check if it's a signer
- public fun get_secret (caller: address):String acquires Vault{
- assert! (caller == @owner,NOT_OWNER);
+ public fun get_secret (caller: &signer):String acquires Vault{
+ assert! (signer::address_of(caller) == @owner,NOT_OWNER);
Updates
Lead Judging Commences
bube 17 days ago
Submission Judgement Published Assigned finding tags:
Lack of signer check in `get_secret`
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.