First Flight #1: PasswordStore

Summary

The setPassword function in the smart contract exposes the password to public visibility on the blockchain. Whenever this function is called, the transaction data, including the password, is stored on the blockchain and can be viewed and decoded by anyone using tools like Etherscan.

Vulnerability Details

The vulnerability exists in the setPassword function of the PasswordStore contract. When this function is invoked, the newPassword argument value is stored on the blockchain as input data of the transaction. Since the blockchain is a public ledger, anyone can view this transaction data using blockchain explorers like Etherscan or Foundry's cast commands. Furthermore, the input data can be easily decoded to reveal the password, which compromises the privacy and security of the password.

Impact

This vulnerability has a High impact the exposure of the password poses a direct threat to the main functionality of the protocol, which is to securely store and retrieve passwords. The ease of exploitation—where anyone can view and decode the transaction data to obtain the password—further underscores the severity of this vulnerability.

• Impact on the protocol: The protocol's main functionality of securely storing and retrieving passwords is directly compromised.

• Likelihood of exploitation: The exploitation is highly likely as it requires no special conditions—anyone can view and decode the transaction data on the blockchain.

Tools Used

Etherscan: For viewing and analyzing blockchain transactions.

Recommended Mitigation

To mitigate this vulnerability, it is recommended to:

• Avoid Storing Passwords on-chain: It's a bad practice to store sensitive data like passwords on the blockchain. Consider alternative methods of authentication and authorization.

• Use Hashing: If it's essential to verify a password on-chain, consider storing a hash of the password instead of the plain text password. This way, even if the hash is visible, it won't reveal the actual password.

• Use Off-chain Solutions: Consider using off-chain solutions for storing and verifying passwords, which would keep sensitive data off the public blockchain.

• Implement Access Control: Ensure that only authorized users can call sensitive functions, reducing the chances of malicious exploitation.