Root + Impact

Description

• Normally, only the contract’s designated owner should be able to retrieve the secret.

• The current implementation accepts a user-supplied caller address, which means anyone can pass @owner and satisfy the authorization check.

This results in a complete confidentiality failure, because the check depends on attacker-controlled input instead of a verified signer. Since the function is also marked #[view], attackers can exploit this at zero cost and retrieve the secret without leaving an on-chain trace.

Risk

Likelihood:

• Every call to get_secret is vulnerable, since the check relies entirely on user input.

• The #[view] decorator exposes this function to anyone off-chain without transaction costs.

Impact:

• Any attacker can read the owner’s secret by supplying @owner.

• Complete loss of confidentiality of stored secrets.

Proof of Concept

Recommended Mitigation

By requiring a &signer instead of an untrusted address, the function ensures that only the authenticated transaction signer is authorized. Using signer::address_of prevents spoofing, and cloning the string returns a safe copy of the stored secret. This closes the confidentiality leak.