Submission Details
Severity:
A smart contract is not safe enough to Save password without encryption
Summary
A smart contract is not safe enough to Save password without encryption as it is public
Vulnerability Details
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
/*
* @notice This allows only the owner to retrieve the password.
* @param newPassword The new password to set.
*/
function getPassword() external view returns (string memory) {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
return s_password;
}
The state of s_password can be easily tracked down and used by bad actors
Impact
Total exposure of Password
Tools Used
Manual Review
Recommendations
encryption before setting password and decryption when getting password
function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert("PasswordStore__NotOwner");
}
// Encrypt the password
bytes32 hashed = keccak256(abi.encodePacked(newPassword));
s_password = hashed.toEthSignedMessageHash().recover(newPassword);
emit SetNetPassword();
}
function getPassword() external view returns (string memory) {
if (msg.sender != s_owner) {
revert("PasswordStore__NotOwner");
}
// Decrypt the password
bytes32 hashed = keccak256(abi.encodePacked(s_password));
return hashed.toEthSignedMessageHash().recover(s_password);
}
Updates
Lead Judging Commences
inallhonesty
almost 2 years ago
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.