First Flight #1: PasswordStore

Summary

Never store passwords on-chain because state variable values are readable from storage slots, regardless of whether the state variable's visibility is set to private.

Vulnerability Details

PasswordStore.sol - Line 14

The s_password state variable's visibility is set to private with the assumption that it won't be visible to other users. In Solidity, private doesn't prevent the reading of its value; it only makes it private for other smart contracts, which cannot access this state variable. However, users off-chain can easily read its value from the smart contract's storage slot.

POC

Follow the steps:

1. Run the local anvil node using the command make anvil.

2. Deploy the smart contract on the local anvil chain using the command make deploy. This will deploy the PasswordStore smart contract and set the new password.

3. Grab the deployed smart contract address from the terminal where you deployed the smart contract. In my case it is 0x5FbDB2315678afecb367f032d93F642f64180aa3

4. Read the storage value of this deployed smart contract using the foundry's cast command. Command: cast storage <contract-address> <storage-slot>. In my case it is cast storage 0x5FbDB2315678afecb367f032d93F642f64180aa3 1 (1 because on the slot 0, owner address is stored and on the slot 1 password).

5. Result: 0x6d7950617373776f726400000000000000000000000000000000000000000014 (string value in bytes form).

6. Convert back to string form using the command cast parse-bytes32-string <bytes value>. In my case it is cast parse-bytes32-string "0x6d7950617373776f726400000000000000000000000000000000000000000014".

7. Result: "myPassword"

We have seen that anyone can read the smart contract's private state variables values from the storage slots.

Impact

The attacker will have access to the password, which can be used to exploit areas where the owner utilizes this password. Based on the user's password pattern, the attacker can also predict passwords for the owner's other platforms.

Tools Used

Manual Review

Recommendations

Never store passwords on-chain.