First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can see contents of s_password variable.

tychaios

Summary

The smart contract PasswordStore.sol is designed to store a private password, but the password is stored in plain text on-chain. This poses a severe security threat as anyone can access the blockchain's storage and retrieve the password since all data on the chain is publicly visible.

Vulnerability Details

In PasswordStore.sol:14, the variable s_password is stored as plain text; anyone can check the contract's storage and get its contents since everything on chain is publicly visible..

string private s_password;

PoC

function test_obtain_raw_password() public {
vm.startPrank(owner);
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
vm.stopPrank();
​
bytes32 contractSlot = vm.load(address(passwordStore), bytes32(uint256(1)));
// Since expectedPassword is shorter than 32 bytes we can manipulate the slot directly
string memory s = string(abi.encodePacked(bytes13(contractSlot)));
assertEq(s, expectedPassword);
}

Impact

This vulnerability allows malicious actors or curious users to easily access and read the password, rendering the purpose of the contract - to keep the password private - completely ineffective.

Tools Used

Manual Review

Recommendations

It is highly recommended to store the hash of the password instead of the plain text password. This ensures that even if someone accesses the contract's storage, they won't be able to easily retrieve the original password. Furthermore, it's essential to understand that smart contracts are not an appropriate place to store information that is meant to remain private. Regardless of the visibility assigned to a variable, anyone can see the values a variable holds on the blockchain.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.