First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Blockchains are public and transparent and should not store private data

MikeDougherty

Summary

Blockchains are public and transparent which will expose any data, even if is private to the world.

Vulnerability Details

To quote Smart Contract Vulnerabilities :: Unencrypted Private Data On-Chain:

Ethereum smart contract code, storage, and any data transacted on-chain can always be read.

Which means that s_password value, and any update to it using setPassword(string), will expose the value of the password to everyone. The value of the password can be read by viewing the transaction data.

This can be seen by running forge script script/DeployPasswordStore.s.sol --rpc-url ${ANVIL_URL} and then opening broadcast/DeployPasswordStore.s.sol/31337/dry-run/run-latest.json.

{
"hash": "0xecade6af26fa6e3e3eb72078acf5298467f7f315a2d44345121aaadafde7a542",
"transactionType": "CALL",
"contractName": "PasswordStore",
"contractAddress": "0x5FbDB2315678afecb367f032d93F642f64180aa3",
"function": "setPassword(string)",
"arguments": [
"myPassword"
],
"transaction": {
"type": "0x02",
"from": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
"to": "0x5fbdb2315678afecb367f032d93f642f64180aa3",
"gas": "0x10082",
"value": "0x0",
"data": "0x290bb4530000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a6d7950617373776f726400000000000000000000000000000000000000000000",
"nonce": "0x1",
"accessList": []
},
"additionalContracts": [],
"isFixedGasLimit": false
}

Demonstrating that the s_password is sent to the contract in clear text when an update is made.

Impact

The s_password value will be publicly available, therefore any data or service relying on it for security will be vulnerable.

Tools Used

Manual Review and Foundry

Recommendations

Try not store private, secure and/or secret information on blockchains. However, if it is absolutely necessary, it should be encrypted at rest as well as in transit.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.