First Flight #1: PasswordStore

Summary

Attacker can front-run attack to function getPassword to retrieve unauthorized password.

Vulnerability Details

The getPassword function is susceptible to front-run attacks, which means an attacker can exploit the timing of transactions to observe and manipulate the password retrieval process.

Impact

If an attacker successfully performs a front-run attack on the getPassword function, they can gain unauthorized access to the password stored in the contract. This could lead to unauthorized disclosure of sensitive information or unauthorized access to the system or accounts associated with the password.

Tools Used

Manual code review

Recommendations

Implement Commit-Reveal Scheme: Introduce a commit-reveal scheme to protect the sensitive password during the retrieval process. This ensures that the password remains hidden until the reveal phase, making it difficult for front-runners to observe and manipulate the data.