First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Non limited password storage

0xVinylDavyl

Summary

The code stores sensitive password data on the blockchain. It's important to consider whether it is necessary to store such sensitive data on the public and immutable blockchain, as there may be more secure and privacy-preserving alternatives.

Vulnerability Details

The code stores the password as a plain string in the contract's storage. This approach is not recommended for storing sensitive information like passwords, as it exposes the password to anyone who can access the Ethereum blockchain.

string private s_password;

Impact

Storing sensitive data like passwords on the blockchain has the following impact:

  • It exposes the sensitive data to anyone who can access the blockchain, compromising the confidentiality and security of the data.

Tools Used

No specific tools are used for this analysis. It's a manual code review based on the provided code.

Recommendations

To address the "Limit Password Storage" concern, it's recommended to reconsider whether it's necessary to store sensitive data like passwords on the blockchain. In many cases, storing sensitive data on a public blockchain is not recommended.

If storing sensitive data is unavoidable, consider using off-chain storage solutions or encryption techniques. Here's an example of how you can handle this:

// Use a library like OpenZeppelin's Ownable for access control
import "@openzeppelin/contracts/access/Ownable.sol";
​
contract PasswordStore is Ownable {
string private s_passwordHash;
​
event SetNetPassword();
​
function setPassword(string memory newPassword) external onlyOwner {
// Hash the password before storing it
s_passwordHash = keccak256(abi.encodePacked(newPassword));
emit SetNetPassword();
}
​
function checkPassword(string memory password) external view onlyOwner returns (bool) {
// Compare the stored password hash with the hash of the provided password
return keccak256(abi.encodePacked(password)) == s_passwordHash;
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Invalidated
Reason: Other
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.