First Flight #1: PasswordStore

Summary

The private state variable 's_password,' which is intended for storing the owner's password, can be read by anyone who has the contract address. This allows the owner's password to be accessed, potentially resulting in the loss of secret data that could be maliciously used to access the intended service.

Vulnerability Details

Suppose Alex, the owner of the contract, has set the password to 'oldPass123' at the deployed contract address as shown below using foundry.

Eve, the attacker, can inspect the contract and discover that the private variable 's_password' is stored in slot 1 in EVM storage. She can then access the value stored in slot 1 for the given contract address, convert the returned hex value to a string, and reveal the password set by the owner, Alex.

This way Eve can access the private data set by Alex and potentially misuse the password before Alex.

Impact

Sensitive data is publicly visible giving the attacker an opportunity to act maliciously.

Tools Used

Foundry

Recommendations

There are two remedies for this attack:

1. Sensitive data should not be stored on-chain or through a smart contract since the information is publicly available. Private data, such as passwords or keys, should be stored off-chain.

2. Sensitive data should be hashed or encrypted before sending it to the contract, and only the hash should be stored.Although hashes cannot be decrypted to reveal the original string. Solidity provides some hash functions that can be used: Keccak256 (SHA-3 by Ethereum), SHA256, and RIPEMD-160."0