Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

move_to prevents updating the secret

pwnerr

Root + Impact

Description

  • Normally, the vault owner should be able to rotate or update their secret multiple times.

  • The current implementation uses move_to directly, which aborts if the resource Vault already exists at the account, preventing any updates.

This creates an availability and usability problem: after the very first secret is stored, the owner is permanently locked out from making changes. In practice, this means secrets cannot be rotated, corrected, or revoked, which goes against real-world requirements of secret storage systems.

public entry fun set_secret(caller:&signer, secret:vector<u8>){
let secret_vault = Vault{secret: string::utf8(secret)};
@> move_to(caller, secret_vault); // Aborts if Vault already exists
event::emit(SetNewSecret {});
}

Risk

Likelihood:

  • This occurs immediately after the first successful secret set.

  • Every subsequent attempt to store a secret will abort due to the existing resource.

Impact:

  • Owner cannot rotate or replace their secret.

  • Permanent denial of service for secret management.

Proof of Concept

// First call: succeeds
set_secret(owner_signer, b"secret1");
​
// Second call: aborts at move_to
set_secret(owner_signer, b"secret2"); // transaction fails

Recommended Mitigation

The fix ensures that if a Vault resource already exists, it is updated in-place via borrow_global_mut rather than replaced. If no vault exists, it falls back to move_to. This provides safe secret rotation and prevents permanent lockout after the initial secret is stored.

- move_to(caller, Vault{ secret: string::utf8(secret) });
​
+ if (exists<Vault>(signer::address_of(caller))) {
+ let v = borrow_global_mut<Vault>(signer::address_of(caller));
+ v.secret = string::utf8(secret);
+ } else {
+ move_to(caller, Vault{ secret: string::utf8(secret) });
+ }
Updates

Lead Judging Commences

bube Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

The `secret` can not be updated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.