Submission Details
Severity:
on-chain storage is publicly readable, never store the secrets on-chain
on-chain storage is publicly readable, never store the secrets on-chain
Description
set_secret functionstores secret directly on-chain which is publicly visible to anyone on the public mempool.
public entry fun set_secret(caller:&signer,secret:vector<u8>){
@> let secret_vault = Vault{secret: string::utf8(secret)};
move_to(caller,secret_vault);
event::emit(SetNewSecret {});
}
Risk
Likelihood: high
Any user setting the secret for vault is publicly visible to anyone on the public mempool
Impact: high
-
Vault containing funds can be drained out by the attacker using public mempool to exploit the vault
Recommended Mitigation
Use secure way of storing the secrets to prevent the exploit for draining the funds
Updates
Lead Judging Commences
bube 4 months ago
Submission Judgement Published Assigned finding tags:
Anyone can see the `secret` on chain
Rewards breakdown
nSLOC
30This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.