First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Stroing passwords as plain text, even in private variables, can make them accessible to anyone through the blockchain.

pratred

Summary

In the PasswordStore.sol file owners password is stored in a private variable named s_password. Storing passwords even in private variables can make them easily accessible to anyone to read it through the blockchain.

Vulnerability Details

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Storing a password in a private variable gives rise to a potential security vulnerability. An attacker can retrieve the stored password, compromising user's data security.

Impact

Any password saved by the user using this contract would be directly accessible to anyone by reading them from the slots.

POC

Anyone can read the data of s_password variable just by using some functions. Some of the are listed below.

  1. web3.eth.getStorageAt(<contract address>, <slot>)

  2. cast storage <contract address> <slot>

Tools Used

VS Code

Recommendations

Do not save password in the plain text format . First hash it and then save it in the s_password variable.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.