Unencrypted Private Data On-Chain
Summary
The PasswordStore smart contract contains a critical vulnerability that allows any user to access and retrieve the private password stored within the contract.
Vulnerability Details
According to the Project, "This contract allows you to store a private password that others won't be able to see."
However, Ethereum smart contract code, storage, and any data transacted on-chain can always be read. So, Anyone can read private on-chain data.
One can simply use cast tool to fetch on-chain private data of any address:
Impact
Anyone can read the Password of the user. Private data should never be stored on-chain unencrypted.
Tools Used
Manual Analysis
Recommendations
Any private data should either be stored off-chain, or carefully encrypted.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.