First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

we can access the `password byte32` by using the `web3.eth.getStorageAt` function

naman1729

Summary

  • we can access the password byte32 by using the web3.eth.getStorageAt function. This function returns the value of the storage at a given position of the address.

const c = await web3.eth.getStorageAt(
"0x1E69cb80921A413F96e24DE10124770b820b0119",
1
);
console.log(c);

this will return the password in byte32 format then we convert byte32 to string . 0x1E69cb80921A413F96e24DE10124770b820b0119 is a sepolia contract address.

Vulnerability Details

const c = await web3.eth.getStorageAt(
"0x1E69cb80921A413F96e24DE10124770b820b0119",
1
);
console.log(c);

this will return the password in byte32 format.

​
// SPDX-License-Identifier: MIT
pragma solidity 0.8.18;
​
contract Bytes32ToString {
​
function bytes32ToString(bytes32 passwordInByte32) public pure returns (string memory) {
uint8 i = 0;
​
while(i < 32 && passwordInByte32[i] != 0) {
i++;
}
​
bytes memory bytesArray = new bytes(i);
​
for (i = 0; i < 32 && passwordInByte32[i] != 0; i++) {
bytesArray[i] = passwordInByte32[i];
}
​
return string(bytesArray);
}
}
​

this is the contract that converts the byte32 to string format and then we get the password.

Impact

  • Anyone can get the password of the owner without calling the getPassword function.

Tools Used

  • Remix

  • foundry

Recommendations

  • we can take encrypted password as the parameter of the setpassword function which can only decrypted by the owner private key.

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.