First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized Access to Private Password

light

Summary

In the comments it is specified that only the owner can retrieve the password. However this can be bypassed by reading the value directly of the storage.

Vulnerability Details

The contract implements a function called getPassword which prevents callers who are not the owner of the contract from reading the password. As the password is stored in the second storage slot of the contract, anyone can read its value, making the contract vulnerable.
After deploying the contract, we can use cast to check the value of storage slot 1 within the contract.

cast storage 0x5fbdb2315678afecb367f032d93f642f64180aa3 1
0x6d7950617373776f726400000000000000000000000000000000000000000014
>>> print(bytes.fromhex('6d7950617373776f7264').decode('utf-8'))
myPassword

Impact

Unauthorised users can gain access to private data, undermining the intent of the smart contract.

Tools Used

manual review

Recommendations

Do not store private data on the blockchain as it can be read by anyone.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.