Submission Details
Severity:
Publicly readable secret by humans
Publicly readable secret
Description
The vault is intended to store a secret that only the owner can access. However, the secret is not hashed before stored in plain UTF-8 string anyone who queries the blockchain state.
struct Vault has key {
secret: String @> // Secret stored in plaintext on-chain
}
Risk
Likelihood: High
Anyone with access to the blockchain state can read the vault's secret field.
Impact: High
Sensitive information intended to be private are exposed publicly on chain.
Proof of Concept
Use the blockchain explorer or indexed to ge back the data
Recommended Mitigations
Hash the secret off-chain before storing it on-chain
Updates
Lead Judging Commences
bube 17 days ago
Submission Judgement Published Assigned finding tags:
Anyone can see the `secret` on chain
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.