Aptos Pizza Drop
Cyfrin
Beginner FriendlyGameFi
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

Unauthorized Module Initialization

raminidalf

Root + Impact

Description

  • init_module can be called multiple times, creating multiple resource accounts.

let (resource_signer, resource_signer_cap) = account::create_resource_account(deployer, seed); // @> no singleton check

Risk

Likelihood:

  • Deployers may call init_module multiple times.

Impact:

  • Multiple resource accounts, balance confusion, potential fund loss.

Proof of Concept

// Call init_module twice

Recommended Mitigation

+ assert!(!exists<ModuleData>(signer::address_of(deployer)), E_ALREADY_INITIALIZED);
- let (resource_signer, resource_signer_cap) = account::create_resource_account(deployer, seed);
+ let (resource_signer, resource_signer_cap) = account::create_resource_account(deployer, seed);
Updates

Appeal created

bube Lead Judge 12 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.