First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can see the password

0xhuy0512

Summary

Only the owner should see the password, but anyone can see it

Vulnerability Details

Even tho the function getPassword() will reverted if the sender is not the owner and the password string is a private variable, there are ways to know it
Way 1: Anyone can go to etherscan of this contract address and see the input of the latest transaction that calling this function setPassword()
Way 2: Anyone can get the value of the slot the s_password occupy
Example using ethers: await provider.getStorageAt("*CONTRACT_ADDRESS*", 1)
Link: https://docs.ethers.org/v5/single-page/#/v5/api/providers/provider/-%23-Provider-getStorageAt

string private s_password;
function getPassword() external view returns (string memory) {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
return s_password;
}

Impact

Tools Used

Recommendations

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.