Submission Details
Impact:
Likelihood:
Lack of Access Control on set_secret Function Allows Anyone to Overwrite Owner’s Secret
Lack of Access Control on set_secret Function Allows Anyone to Overwrite Owner’s Secret
Description
Without proper access control, any user can call the set_secret function and replace the existing secret. This completely defeats the purpose of a private vault and can cause loss of stored data for the owner. On Aptos, there’s no way to recover overwritten data, making the vulnerability!!!
Risk : High
Likelihood: High
The vulnerability is trivial to exploit and does not require any special conditions beyond calling the function.
IMPACT : High
Recommended Mitigation
+ public fun set_secret(account: &signer, new_secret: vector<u8>) {
+ assert!(signer::address_of(account) == self.owner, E_NOT_OWNER);
+ self.secret = new_secret;
}
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.