First Flight #1: PasswordStore

Summary

Marking a variable as private doesn't mean that it's hidden from view. Any user with enough knowledge can see the data stored in it.

Vulnerability Details (PoC)

To prove the concept, we need to deploy a contract on the blockchain and add a value to s_password.
In our case, we use Anvil (Foundry) and deploy the contract on it with the first account given to us.

Then, as the owner, using cast, we set a value in s_password:

Now we are going to run 2 instructions that do not require user validation, i.e. we do not use the owner's private key to obtain the information.

First, find out which is the memory slot for `s_password``

As we can see, it is slot 1. Now, we check the info inside. We get the information in hexadecimal, so we have to translate it to ASCII.

Impact

Since the password is no longer private, anyone can use it to change information, make transactions or steal assets.

Tools Used

Foundry (anvil, cast), terminal.

Recommendations

In web3 we do not use stored passwords as a method of keeping things private.

There are 2 ways to secure the systems:

1.- Asymetric encryption (wallets or signatures).

2.- Access control modifiers. We can use the Open Zeppelin libraries which are specifically designed for this:

https://docs.openzeppelin.com/contracts/2.x/access-control