Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Anyone can store a secret

merlinboii

Root + Impact

Description

  • The module is intended for the owner to store a secret, but currently any account can call set_secret and create their own Vault resource.

  • There is no access control restricting secret creation to a specific owner or admin address.

public entry fun set_secret(caller: &signer, secret: vector<u8>) {
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller, secret_vault);
event::emit(SetNewSecret {});
}

Risk

Likelihood: High

  • This issue will occur any time a non-owner account calls set_secret.

Impact: Low

  • Any account can create a Vault resource for themselves, breaking the main invariant.

Proof of Concept

  • Put the test_anyone_set_secret into the test section of secret_vault.move.

  • Run the test with aptos move test -f test_anyone_set_secret.

#[test(user = @0x123)]
fun test_anyone_set_secret(user: &signer) acquires Vault {
use std::string;
use aptos_framework::account;
​
account::create_account_for_test(signer::address_of(user));
let secret = b"i'm a user secret";
set_secret(user, secret);
​
// verify the secret was set
let user_addr = signer::address_of(user);
let valut = borrow_global<Vault>(user_addr);
assert!(valut.secret == string::utf8(secret));
}

Recommended Mitigation

Restrict the set_secret function so that only the designated owner (or a whitelist/admin) can create or update the Vault resource.

public entry fun set_secret(caller: &signer, secret: vector<u8>) {
+ assert!(signer::address_of(caller) == @owner, NOT_OWNER);
let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller, secret_vault);
event::emit(SetNewSecret {});
}
Updates

Lead Judging Commences

bube Lead Judge 18 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Anyone can call `set_secret` function

In Move for Aptos, the term "owner" refers to a signer, which is a verified account that owns a given resource, has permission to add resources and the ability to grant access or modify digital assets. Following this logic in this contest, the owner is the account that owns `Vault`. This means that anyone has right to call `set_secret` and then to own the `Vault` and to retrieve the secret from the `Vault` in `get_secret` function. Therefore, this group is invalid, because the expected behavior is anyone to call the `set_secret` function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.