First Flight #1: PasswordStore

Summary

The contract stores a password in the private storage variable s_password.

Vulnerability Details

In solidity, private variables are only private internally. They can still be read on the blockchain by external tools such as the web3.eth.getStorageAt() function, or even visually by using etherscan.io to look at the contract's bytecode.

Therefore, anyone can access the value of s_password and this makes the contract insecure.

Impact

Critical vulnerability

Tools Used

vscode, anvil, forge

Recommendations

instead of storing the password in plain text, it could be encrypted off-chain and the encrypted password passed to the setPassword function. This way the password is stored in an encrypted format and cannot be decrypted by anyone without the private key used to encrypt it.