Description

• The Secret Vault contract has a design flaw that makes it completely unusable. Users can store secrets but can never retrieve them.

• The get_secret() function contains this check:

• Caller can never be same as owner address

Problem: Only the hardcoded @owner address can call this function

Risk

Likelihood:

• HIGH

Impact:

• Permanent data loss - stored secrets become inaccessible forever

• Complete service breakdown - users can write but never read their data

  
  

Proof of Concept

• USER FLOW

• Regular users store secrets at their own addresses

• Regular users are NOT the owner

• The function always fails for legitimate users

Recommended Mitigation

• Add these checks to correctly check and give access to the users