Secret Vault on Aptos
First Flight #46
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Secrets stored on-chain are publicly readable

giannistbs

Root + Impact

Description

  • Normal behavior: A vault should keep the stored secret readable only by its owner.

  • Issue: The secret is stored in plaintext inside an on-chain Move resource. All full nodes (and anyone querying the Aptos REST API) can read the raw bytes. Access checks in #[view] functions do not hide storage.

// secret_vault.move (relevant excerpt)
module secret_vault::vault {
struct Vault has key {
@> secret: String
}
​
#[view]
public fun get_secret(caller: address): String acquires Vault {
// @> Returns the plaintext secret from on-chain storage
let vault = borrow_global<Vault>(@owner);
@> vault.secret
}
}

Risk

Likelihood:

  • Every time a secret is written to chain, it is not truly a secret.

Impact:

  • Confidential data disclosure for every user.

  • Irreversible exposure: once published to chain, the secret cannot be recalled.

Proof of Concept

Recommended Mitigation

You could only store encrypted bytes on-chain so decryption can happen off-chain with a private key

Updates

Lead Judging Commences

bube Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can see the `secret` on chain

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.