Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Anyone can store a secret

romfoll

Anyone can store a secret and misuse a protocol

Description

  • Only the owner should be able to store a secret

  • Anyone can store a secret

public entry fun set_secret(caller:&signer,secret:vector<u8>){
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
event::emit(SetNewSecret {});
}

Risk

Likelihood:

  • When the malicious actor calls the public entry "set_secret" function.

Impact:

  • Misuse the purpose of the protocol.

Proof of Concept

This move test function demonstrates how an arbitrary user with an 0x123 address in this case could set his secret.

#[test(user = @0x123)]
fun test_set_secret_by_anyone(user: &signer) acquires Vault{
use aptos_framework::account;
account::create_account_for_test(signer::address_of(user));
let secret = b"i'm a super secret";
​
set_secret(user, secret);
let user_address = signer::address_of(user);
let vault = borrow_global<Vault>(user_address);
assert!(vault.secret == string::utf8(secret), 6);
}

Recommended Mitigation

The recommended mitigation is to add a checker if the caller is the owner.

public entry fun set_secret(caller:&signer,secret:vector<u8>){
+ assert!(signer::address_of(caller) == @owner, NOT_OWNER);
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
event::emit(SetNewSecret {});
}
Updates

Lead Judging Commences

bube Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Anyone can call `set_secret` function

In Move for Aptos, the term "owner" refers to a signer, which is a verified account that owns a given resource, has permission to add resources and the ability to grant access or modify digital assets. Following this logic in this contest, the owner is the account that owns `Vault`. This means that anyone has right to call `set_secret` and then to own the `Vault` and to retrieve the secret from the `Vault` in `get_secret` function. Therefore, this group is invalid, because the expected behavior is anyone to call the `set_secret` function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.