Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Lack of Data Encryption

Summary

The current implementation stores passwords in plain text, posing a significant security risk.

Vulnerability Details

The s_password variable is stored in plain text, leaving it susceptible to potential data leaks and unauthorized access.

Impact

This vulnerability exposes all stored passwords to potential compromise if there is any unauthorized access or data leak.

Tools Used

The identification of this vulnerability was based on manual analysis.

Recommendations

Storing passwords in plain text on a public blockchain is highly discouraged due to security concerns. To enhance security, consider implementing industry-standard practices such as password hashing, salting, and encryption techniques like AES-256. These measures will significantly improve the protection of sensitive password data and help prevent unauthorized access and data leaks.

Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.