Submission Details
Severity:
Dangerous to store sensitive info onchain
Summary
It is dangerous to store sensitive information on chain.
Vulnerability Details
The contract store sensitive info(password) on chain which can be got by malicious party by multiple ways:
query/decode
setPasswordtransactionquery storage, for example:
function test_read_password() public {
vm.startPrank(owner);
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
bytes32 passFromStore = vm.load(address(passwordStore), bytes32(uint256(1))); // slot 1
console.log(string(abi.encodePacked(passFromStore)));
}
Impact
Sensitive information leak.
Tools Used
Manual, Foundry
Recommendations
Try not store sensitive info onchain
Updates
Lead Judging Commences
inallhonesty
about 2 years ago
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.