First Flight #1: PasswordStore

Summary

The PasswordStore contract exposes critical vulnerabilities related to access control and confidentiality of data. Specifically, the setPassword function lacks appropriate access control, and the password is exposed in the transaction's calldata which is publicly visible in the mempool.

Vulnerability Details

1. Access Control Issue: The setPassword function is designed to set a new password for the contract. However, there is no access control mechanism in place to restrict this action to the contract's owner. As a result, any Ethereum user can call this function to overwrite the password.

2. Mempool Exposure: When a transaction is sent to the Ethereum network, its calldata is stored in the mempool before it is included in a block. Since the mempool is public, malicious actors can inspect it to see the calldata of the setPassword function, thereby obtaining the plaintext password even before the transaction gets mined.

Impact

1. Any external actor can change the password without the owner's consent, leading to potential unauthorized access.

2. Password confidentiality is compromised as it can be seen by anyone monitoring the mempool, making the stored password effectively public.

Tools Used

• Manual code review

Recommendations

1. Implement an access control mechanism in the setPassword function to ensure that only the contract's owner can change the password.

2. Consider encrypting the password before sending it to the contract, or avoid storing sensitive information on-chain altogether.