Passwords are plain-text
Summary
Passwords are stored on-chain, and anyone knowing the ABI of the contract, can decode the password from transaction's call data.
Vulnerability Details
Send tx to "setPassword(string)" method with any password, e.g. "secret"
Get transaction data (e.g.
cast tx *tx_hash*)Decode the calldata, e.g. using foundry
will output:
Impact
Password can be easily read and exploited.
Tools Used
foundry (cast)
Recommendations
Encrypt password off-chain, don't send plain-text.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.