storing s_password in a state variable not safe
Summary
In PasswordStore::s_password should not store passwords in a state variable because it is not private and can be revealed.
Vulnerability Details
Storing passwords in a state variable even if it is marked private is not good because that information can still be seen on the blockchain. Marking a state variable as private only prevents other contracts from accessing it.Private variables are still able to get accessed by the public.
Impact
If you use cast storage <contractAddress> <storageSlot> you are able to check each storage slot within the contract in this case you would be able to check s_password
Tools Used
Foundry
Recommendations
Do not store passwords in private variables on the blockchain instead use cryptographic hashes.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.