Storing sensitive data on the blockchain
Summary
Password field can be accessed despite it being a private field
Vulnerability Details
Storage slots of contracts can be accessed by libraries such as ethers.js or web3.js. A malicious user can simply call a function and directly access storage slot with index 1 to get the user's password.
Impact
User's password will be public information which can lead to more issues if the same password is used in other places.
Tools Used
Manual Review
Recommendations
Do not use the blockchain to store sensitive information such as passwords and anything other you might consider private information. Use traditional databases or password managers for that.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.