Submission Details
Severity:
One Time Set of secret No Update Path
Description
The owner should be able to update the secret.
Using move_to will abort if a Vault already exists, there’s no move_from/replace logic, so the secret becomes immutable after first set.
// move
@> move_to(caller, secret_vault); // aborts if Vault already exists at address
Risk
Likelihood:
Triggers on the second attempt to set the secret.
Impact:
Owner cannot rotate/update secrets, poor UX and potential security risk.
Proof of Concept
// move
set_secret(owner, b"first"); // ok
set_secret(owner, b"second"); // aborts: resource exists
Recommended Mitigation
Consider Making this changes
- move_to(caller, secret_vault);
+ if (exists<Vault>(@owner)) {
+ let _old = move_from<Vault>(@owner);
+ // (drop _old)
+ }
+ move_to(caller, secret_vault);
Updates
Lead Judging Commences
bube 16 days ago
Submission Judgement Published Assigned finding tags:
The `secret` can not be updated
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.