First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unencrypted Private Data On-Chain on PasswordStore password

cryptonoob

Summary

Ethereum smart contract code, storage, and any data transacted on-chain can always be read. Treat it as such. Even if your code is not verified , attackers can still decompile or check transactions to and from it to analyze it. For this reason, it's imperative that private data is never stored on-chain unencrypted.

Vulnerability Details

PasswordStore stores unencrypted password so an attacker (using a blockchain explorer or node) could query the variable storage storage slot to retrieve the password in hexadecimal format.

The vulnerability occurs due to the false assumption that if a variable is marked as private then no one could read it and because the password is stored in clear text

Proof of Concept

Add the following function in provided test file PasswordStore.t.sol:

function test_non_owner_set_password() public {
vm.startPrank(address(1));
string memory expectedPassword = "NonOwner";
passwordStore.setPassword(expectedPassword);
​
// Use load to getPassword from storage slot
bytes32 slotPwd = vm.load(
address(passwordStore),
bytes32(uint256(1))
);
console.log("Modifieds password: ");
console.logBytes32(slotPwd);
}

Run the test with verbose option:

forge test -vv

Observe the password is retrieved in hexadecimal format

Impact

Anyone could read the contract sensitive password

Tools Used

Manual analysis

Recommendations

Encrypt the password using EOA private key before storing to the blockchain

References

https://consensys.github.io/smart-contract-best-practices/development-recommendations/general/public-data

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.