First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reading password from storage slot

0xdark1337

Summary

The storage variable string private s_password takes the storage slot 1 can be read and able to retrieve the password irrespective of it's visibility.

Vulnerability Details

The string private s_password can be read using following code, (for testing, I deployed the code locally in remix)

function readFromStorage(uint256 i) public view returns(bytes32 content){
assembly{
content := sload(i)
}
​
}

Impact

When calling the readFromStorage function with i equals 1 it will return the password in bytes32 format, which can be converted in to text to retrieve the password.

Tools Used

Remix IDE

Recommendations

Encrypt the password with a private key which is known only to the owner when storing it to the storage.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.