setPassword() exposes new password
Summary
The argument for setPassword is in plain string format, which would expose the new password easily to anyone looking at the transaction. Furthermore, this critical function should not be emitting an event which would alert others to the transaction.
Vulnerability Details
The argument for setPassword is in plain string format, which would expose the new password easily to anyone looking at the transaction. Furthermore, this critical function should not be emitting an event which would alert others to the transaction.
Impact
Potential loss of password and control of contract
Tools Used
Hardhat
Recommendations
New password should be encoded. Remove event SetNetPassword().
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.