Submission Details
Severity:
Inappropriate Function Visibility Pattern
Description
The get_secret() function is marked as #[view] but handles sensitive data retrieval. View functions are typically used for read-only operations that don't require transaction signing.
public fun get_secret (caller: address):String acquires Vault{
Impact
Potential security implications for sensitive data access
Inconsistent access pattern compared to
set_secret()May not provide proper transaction authentication
Recommendation
Consider changing to entry function for better security:
public entry fun get_secret(caller: &signer) acquires Vault {
let caller_address = signer::address_of(caller);
let vault = borrow_global<Vault>(caller_address);
// Handle secret retrieval with proper authentication
}
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.