First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Exposure of sensitive data due to the public nature of blockchain storage

Osora9

Summary

Despite being marked as private, the s_password variable within the PasswordStore contract can be accessed outside of the contract. This vulnerability stems from the public nature of data on the blockchain, allowing individuals to read storage with knowledge of storage structure and direct access methods like low-level calls.

Vulnerability Details

contract PasswordStore {
error PasswordStore__NotOwner();
​
address private s_owner;
string private s_password;
​
// ...
}
While s_password is intended to be a private variable, its actual storage is not hidden on the blockchain. With the right tools and understanding of the Ethereum storage model, an attacker can directly query the contract's storage using methods like web3.eth.getStorageAt or inline assembly in a malicious contract.
​
from other contracts
```solidity
// Proof of concept using inline assembly:
assembly {
let slotValue := sload(1)
}

or

from web3.js

// Proof of concept using web3.js:
web3.eth.getStorageAt(passwordStoreAddress, slotIndex)
.then((slotValue) => {
console.log("The sensitive `s_password` value is:", web3.utils.hexToUtf8(slotValue));
});
​

These methods bypass typical visibility constraints, illustrating that data on a blockchain is transparent and that 'private' does not mean 'secret'.

Impact

Exposing sensitive information in contract storage can lead to various security threats, including unauthorized access and potential loss of confidentiality. Users might believe their data is secure, but it is publicly accessible.

Tools Used

Ethereum nodes (for direct blockchain querying)
web3.js (for interaction scripts)
Foundry (knowledge of storage layout and inline assembly)

Recommendations

Never store plain sensitive information like passwords directly on the blockchain. Consider zero-knowledge proofs or off-chain storage solutions for such data.
If it's imperative to store sensitive data on-chain, encryption techniques should be used, though they also have limitations given the public nature of blockchain data.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!