inadequate data privacy results in exposed stored password
Summary
Even though the s_password variable is private, it's not truly hidden. Anyone can inspect the contract's storage on the blockchain and retrieve the password.
The contract aims to store a private password securely. However, the current implementation does not ensure the privacy of the stored password
Vulnerability Details
The s_password variable, despite being marked as private, can be accessed by inspecting the contract's storage directly on the blockchain.
Impact
Any user can retrieve the stored password, compromising its confidentiality.
Tools Used
Manual code review.
Recommendations
Consider encrypting the password offchain before storing it onchain.
Decryption should also happen offchain to maintain the password's secrecy.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.