First Flight #1: PasswordStore

Summary

Because the password is stored in plain text (not encrypted), it can be read by anyone.

Vulnerability Details

In this contract, the setPassword function is used to store user passwords on the blockchain. The issue is that some users might not know how to protect their passwords, and they might send them in an unprotected way (unencrypted). This makes it simple for anyone who knows how to read the contract's (using the cast storage command) storage to see the password.

Impact

This vulnerability places users at significant risk, as it allows anyone to read their passwords. Malicious actors could exploit this weakness to compromise user accounts and potentially engage in identity theft, fraud, or other malicious activities.

Tool used

Manual Review

Recommendations

1. User-Friendly Documentation: Given that not all users may be technically proficient, it is essential to provide clear and accessible documentation. Educate users about the importance of securely submitting their passwords in encrypted formats to ensure their data remains safe.

2. Encrypt Password Off-Chain*: Passwords should never be stored in plain text within a smart contract. Instead, implement proper encryption techniques to securely hash passwords before submitting them to the setPassword function. This approach ensures that only the hashed password is stored on the blockchain, protecting user data from potential leaks.