Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Unclear error when secret has not been set

merlinboii

Root + Impact

Description

  • The get_secret() attempts to retrieve the Vault resource for the owner address without first checking if it exists.

  • If the Vault resource has not been set for the owner, borrow_global<Vault>(@owner) will abort.

#[view]
public fun get_secret (caller: address):String acquires Vault{
assert! (caller == @owner,NOT_OWNER);
let vault = borrow_global<Vault >(@owner);
​
vault.secret
}

Risk

Likelihood: Medium

  • This issue will occur if a user tries to get the secret before it has been set.

Impact: Low

  • Users or integrators may be confused by the generic error message, leading to a poor user experience and more difficult debugging.

Proof of Concept

  • Put the test_get_secret_before_set into the test section of secret_vault.move.

  • Run the test with aptos move test -f test_get_secret_before_set.

#[test(owner = @0xcc)]
#[expected_failure(major_status = 4008, location = Self)]
fun test_get_secret_before_set(owner: &signer) acquires Vault {
use aptos_framework::account;
​
account::create_account_for_test(signer::address_of(owner));
​
// must fail
let owner_address = signer::address_of(owner);
get_secret(owner_address);
​
}

Recommended Mitigation

  • Before calling borrow_global<Vault>(@owner), check if the resource exists and provide an explicit error code or message.

  • Document the new error code for clarity.

public fun get_secret(caller: address): String acquires Vault {
assert!(caller == @owner, NOT_OWNER);
+ assert!(exists<Vault>(@owner), E_SECRET_NOT_SET); // Custom error for not set
let vault = borrow_global<Vault>(@owner);
vault.secret
}
Updates

Lead Judging Commences

bube Lead Judge 18 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Lack of `Vault` existence check in `get_secret`

There is no security impact on the protocol, therefore this is an Informational finding. Also, it is a user mistake, if the user calls `get_secret` without first calling `set_secret`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.