Root + Impact

Description

Summary

The get_secret function in the Secret Vault contract contains a critical access control vulnerability that allows anyone to retrieve any vault owner's secret by simply providing the owner's address as a parameter.

Vulnerability Details

Root Cause

The vulnerability exists in the get_secret function on line 28-33:

The Problem: The function accepts a caller: address parameter and checks if it equals @owner, but this parameter can be controlled by anyone calling the function. The actual transaction sender is never validated.

Expected Behavior

The function should verify that the actual transaction sender (using &signer) is the owner of the vault, not just check an arbitrary address parameter.

Actual Behavior

Anyone can call get_secret(@owner) and successfully retrieve the owner's secret, completely bypassing the intended access control.

Risk

Likelihood

High, any one can get the secret by just providing the owners address, which can be found from the block explorer

Impact

Exposure of secret data

Proof of Concept

N/A

Recommended Mitigation

Replace the vulnerable function with proper access control:

Key Changes:

1. Change parameter from caller: address to caller: &signer

2. Extract the actual caller's address using signer::address_of(caller)

3. Verify the actual transaction sender, not an arbitrary parameter