ineffective access control in get_secret function, any caller can pass @owner as the argument to satisfy this check

• get_secret function has ineffective access control, anyone can pass @owner as function argument to satisfy the check and the function is callable by anyone

Risk

Likelihood: high

• Any caller can pass @owner as function param to get the vault secret. If vault contains any funds, it can be exploited by the attacker

Impact: high

• Vault containing funds can be drained out by the attacker as the view function is callable by anyone

Recommended Mitigation

• Remove the caller param and directly check whether the caller is owner or not, and maintain the owner state variable to track the owner of the vault. Such that, only owner can call the get_secret function