First Flight #1: PasswordStore

Summary

Declaring PasswordStore::s_password() as private does not guarantee that it cannot be accessed on-chain. Attackers can inspect contract transactions to retrieve values stored in the contract's state.

Vulnerability Details

Any user can make an RPC call to access this slot in the contract and retrieve the stored value.

Proof of Concept (PoC)

The script and commands below demonstrates the validity and severity of the vulnerability.

How to Run the PoC

Requirements

• Install Foundry.

• Clone the project codebase to your local workspace.

• Create a .env file in your root folder and add the required variables.

• The .env file should follow this format:

Step-by-step Guide to Run the PoC

1. Ensure the above requirements are met.

2. Load .env variables into the terminal by running source .env.

3. Deploy the contracts by executing the following command in your terminal:

4. Copy the contract address into a notepad.

5. Note that s_password is set as "myPassword" in the deploy script.

6. Read the s_password value from the contract storage by running:

• Note:

  • Replace 0xPasswordStoreContractAddress with the corresponding PasswordStore contract address.

  • The return value is in byte32 format.

7. Copy the returned data value to your notes.

8. Finally, read the data by converting it from byte32 to ASCII using the following command:

• Note:

  • Replace 0xReturnedByte32Data with the corresponding byte data from your previous execution.

The return value should be "myPassword", which proves that s_password can be read from storage.

Impact

Implications

Exposing user passwords can compromise network security, as attackers can easily gain unauthorized access to user accounts. This poses a significant threat to user experience and general security.

Exploit Scenario

John sets a password for his account, believing that the protocol guarantees the security of his information. However, Sarah, a more technically inclined user, reads the value of John's password, effectively gaining access to his account.

Tools Used

• Foundry

Recommendations

Private data should not be stored unencrypted in contract code or state. Instead, consider encrypting it or storing it off-chain to enhance security and protect user information.