Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Improper Access Control

choaib

Description:
The set_secret function does not assert that the signer is the owner before set the secret!

Impact:
An attacker could set the secret and changed at any time !

Proof of Concept: Add the test :

PoC

#[test(owner = @0xcc, attacker = @0x123)]
fun test_set_secret(attacker:&signer,owner: &signer) acquires Vault{

use aptos_framework::account;
account::create_account_for_test(signer::address_of(owner));
account::create_account_for_test(signer::address_of(attacker));
​
let secret_1 = b"i'm a secret1";
set_secret(owner,secret_1);
​
let secret_2 = b"i'm a secret2";
set_secret(attacker,secret_2);
​
// Get the owner address
let owner_address = signer::address_of(attacker);
​
// Verify the secret was added
let valut = borrow_global<Vault>(owner_address);
​
assert!(valut.secret == string::utf8(secret_2),4);

}

Recommendation Mitigation:

public entry fun set_secret(caller:&signer,secret:vector){

  • assert! (caller == @owner,NOT_OWNER);
    let secret_vault = Vault{secret: string::utf8(secret)};
    move_to(caller,secret_vault);
    event::emit(SetNewSecret {});
    }

Updates

Lead Judging Commences

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Anyone can call `set_secret` function

In Move for Aptos, the term "owner" refers to a signer, which is a verified account that owns a given resource, has permission to add resources and the ability to grant access or modify digital assets. Following this logic in this contest, the owner is the account that owns `Vault`. This means that anyone has right to call `set_secret` and then to own the `Vault` and to retrieve the secret from the `Vault` in `get_secret` function. Therefore, this group is invalid, because the expected behavior is anyone to call the `set_secret` function.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.