Private state variable s_password is accessible
Summary
Private state variables in Solidity such as s_password can be read by directly accessing the contract's storage
Vulnerability Details
Solidity's private keyword prevents other contracts from reading the state variable directly, it doesn't prevent on-chain or off-chain processes from viewing its content by querying the Ethereum storage
Impact
This is a high impact vulnerability, it exposes sensitive information
POC: https://github.com/david-dacruz/2023-10-PasswordStore/blob/607f03007e930ff2a06804a96cae0d624e7224cf/test/PasswordStore.js#L20C3-L45C6
Tools Used
Manual code inspection and hardhat with chai
Recommendations
Avoid storing plain-text sensitive data on-chain, consider encrypting data off-chain and only store its hash on-chain
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.