Submission Details
Impact:
Likelihood:
get_actual_apt_balance exposed
Root + Impact
Description
Any user can see actual contract balance, which may leak sensitive info.
coin::balance<AptosCoin>(resource_addr) // @> no privacy
Risk
Likelihood:
High. This is a publicly exposed view function, meaning it can be called by any external address at any time. No special privileges or conditions are required to exploit this.
Impact:
Significant. The public disclosure of a contract's exact balance can reveal sensitive financial information. This could expose a user or a project's liquidity, making them a target for attackers, or provide a competitive disadvantage. It compromises the privacy of a core financial asset.
Proof of Concept
// Call get_actual_apt_balance from any address
Recommended Mitigation
- pub fn get_actual_apt_balance() ...
+ pub fun get_actual_apt_balance(owner: &signer) ... // restrict to owner only
Rewards breakdown
nSLOC
125This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.