First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Misdesign function

maplerichie

Summary

Suppose only owner can know/read the password. String variable are readable no matter it is public or private variable.

Vulnerability Details

function getPassword() external view returns (string memory) {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
return s_password;
}

The variable s_password declare as private to prevent direct read from contract. Although the function of getPassword() implemented checking of owner, the value is still readable from storage state or calldata.

Impact

Anyone can bypass getPassword(), access and use the s_password

Recommendations

Remove the function, encrypt and store only the encrypted string, the decryption key should store safely off-chain.

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.