Root + Impact

Description

• Normally, only the designated owner account should be able to retrieve the secret from the vault by signing a transaction with their private key.

• In the current implementation, the get_secret function accepts an address parameter from user input rather than validating the actual transaction signer. This allows any account to call the function and supply the owner's public address as an argument, completely bypassing the intended access control mechanism.

  ​

  public fun get_secret(caller: address): String acquires Vault {

  @> assert!(caller == @owner, NOT_OWNER); // Trusts user-supplied address

  let vault = borrow_global<Vault>(@owner);

  vault.secret

  }

  ​

Risk

Likelihood:

• Any external account can call get_secret and simply provide the owner's public address as the caller parameter.

• The owner's address is publicly visible on-chain, making it trivial for attackers to obtain and use.

• No cryptographic verification of transaction signer occurs, making exploitation guaranteed.

Impact:

• Complete breach of confidentiality: anyone can read the supposedly protected secret.

• Undermines the entire security model of the vault system.

• Makes the access control mechanism completely ineffective.

Proof of Concept

Recommended Mitigation