# Recovery can be done without Guardians’ approvals by looking at initial account update tx data

Initial account registration stored social recovery backup with threshold=0, letting anyone holding msk_ss_rik derive keys and decrypt msk without guardian approval.

- Payout: Contest reward
- Severity: medium
- Program: Swafe
- Credited: montecristo
- Disclosed: 2026-05-04
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-11-swafe#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-06
- Tags: domain:web3 impact:data-leak impact:integrity kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:access-control vuln:crypto vuln:misconfiguration

**Target:** on-chain account registration / social recovery backup ciphertext
**Root cause:** create_recovery is called with guardians=[] and threshold=0 at account init, so sss::share returns secret=ZERO and empty shares, making key_meta and key_data deterministically derivable from msk_ss_rik alone.
**Steps:**
1. Observe initial AccountUpdate on chain containing rec.social BackupCiphertext with encap=[] and comms=[]
2. Compute key_meta = kdfn(msk_ss_rik, "KDFMetakey" || [])
3. Compute key_data = kdfn("BackupKDFInput" || msk_ss_rik || Fr::ZERO, "EmptyInfo")
4. Decrypt BackupCiphertext.data to recover msk_ss_social
5. Derive msk_decryption_key from msk_ss_rik + msk_ss_social and decrypt rec.enc_msk to obtain msk
**How found:** Code review of create_recovery call site noticing guardians=[] and threshold=0 defaults, then tracing sss::share returning Fr::ZERO for t==0 and confirming key derivation becomes deterministic from msk_ss_rik.
**Exploitation:** Attacker with msk_ss_rik reads the public initial account update tx, recomputes key_meta/key_data from the zero-threshold sharing, decrypts the social backup ciphertext to get msk_ss_social, then decrypts enc_msk to recover the account master secret without any guardian shares.
**Insight:** When a threshold-secret-sharing scheme treats t=0 as a constant secret, any default-initialized recovery backup becomes decryptable from the RIK alone; check default/zero parameters at initialization paths, not just the happy-path recovery flow.