First Flight #1: PasswordStore

Summary

While the PasswordStore contract itself does not handle Ether or tokens, and therefore doesn't provide direct financial incentive for front-running, there could be external circumstances or dependencies where the timing of a password change is critical.

In a scenario where benefits (financial or otherwise) might accrue from being the first to change the password, the contract is susceptible to front-running because transactions are publicly visible before they're mined.

Vulnerability Details

• Imagine a scenario where an external reward is provided to whoever sets the password to a specific value first (e.g., an off-chain system monitoring the contract state).

• User A sends a transaction to set the password to the desired value.

• User B, monitoring pending transactions, sees this transaction and sends another transaction with a higher gas fee to set the password to the same value.

• Due to the higher gas fee, User B's transaction gets processed first, and they receive the reward instead of User A.

In the current contract, there's no direct impact. However, if combined with external incentives or future contract updates, this could be exploited, hence the severity is tagged to as Medium.

Impact

Medium

Tools Used

Manual Review

Recommendations

Consider implementing commit-reveal schemes to obscure the true intent of a transaction until after it's mined, use off-chain solutions where transaction order isn't publicly known, or employ mechanisms that don't incentivize being the first to make a specific state change.