Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can retrieve the owner secret via `get_secret()`

merlinboii

Root + Impact

Description

  • The secret of the vault's owner is expected to be accessible only by the vault owner.

  • However, the get_secret() function fails to check the signer, allowing anyone to access the secret.

#[view]
@> public fun get_secret (caller: address):String acquires Vault{
@> assert! (caller == @owner,NOT_OWNER);
let vault = borrow_global<Vault >(@owner);
​
vault.secret
}

Risk

Likelihood: High

  • This issue will occur any time after the owner sets the secret.

Impact: High

  • Anyone can access the owner's vault secret, which can be used for restricted function verification. This allows anyone to impersonate the owner and modify the vault as they wish.

  • This issue breaks a main invariant as it is expected that others should not be able to access the secret.

Proof of Concept

  • Put the test_anyone_reads_secert into the test section of secret_vault.move.

  • Run the test with aptos move test -f test_anyone_reads_secert.

#[test(owner = @0xcc, user = @0x123)]
fun test_anyone_reads_secert(owner: &signer, user: &signer) acquires Vault {
use std::string;
use aptos_framework::account;
​
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(user));
let secret = b"i'm a secret";
set_secret(owner, secret);
​
let owner_addr = signer::address_of(owner);
​
// Read as non-owner “user” — succeeds because view has no auth
let leaked = call_get_secret_as(user, owner_addr);
​
assert!(leaked == string::utf8(secret));
}

Recommended Mitigation

Secrets are stored publicly on-chain and can be accessed in this way or via APIs. It is recommended not to store any sensitive data, such as secrets, on-chain.

Updates

Lead Judging Commences

bube Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of signer check in `get_secret`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.