First Flight #1: PasswordStore

Summary

When calling the setPassword() function, the function argument is publicly accessible using the input data from the transaction, therefore allowing anyone to retrieve the stored password.

Vulnerability Details

The protocol's goal is to allow only s_owner to call getPassword() and retrieve the stored password in s_password. However, when calling the setPassword() function, the function argument is publicly accessible using the input data from the transaction, therefore allowing anyone to retrieve the password used in any transaction that called the setPassword() function. By retrieving the password from the last transaction that called the setPassword() function, anyone can retrieve the stored password.

Impact

Anyone can retrieve the password used in the last transaction that called the setPassword() function, therefore rendering the entire protocol's goal useless.

The following Foundry commands show how to retrieve the password from a transaction that called the setPassword() function:

Tools Used

• Foundry

Recommendations

Don't use this protocol at all, since it's generally a bad idea to store private data on EVM compatible blockchains.

If you insist on using this protocol, you can encrypt the password off-chain before calling the setPassword() function. However, in this case you need to store the encryption key off-chain, which renders the protocol redundant as you could use the encryption key or part of it as your password.