Unencrypted Private Data On-Chain and redundant getPassword() function
Summary
It is a common misconception that private type variables cannot be read. Even if your contract is not published, attackers can look at contract transactions to determine values stored in the state of the contract. For this reason, it's important that unencrypted private data is not stored in the contract code or state.
Vulnerability Details
Unencrypted owner's password can be read on-chain.
Impact
High Severity; The contract's most important invariant is broken.
Tools Used
Foundry cast (Usage: cast storage [OPTIONS]
[SLOT] ) and SWC-136.Recommendations
s_password (private data) should either be stored off-chain, or carefully encrypted.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.