Passwords Can Be Read By Anyone
Summary
Storing sensitive information directly on-chain poses significant privacy and security risks.
Vulnerability Details
The PasswordStore contract saves passwords, s_password, in a storage slot within the contract. This data is stored on-chain, essentially making it public information. Tagging the passwords as private only prevents other smart contracts from viewing the s_password value, not the rest of the world.
Impact
Passwords stored on-chian are not secret and can be read and used by anyone.
Tools Used
Manual Review
Recommendations
Salt & Hash. Do not store plain text passwords on-chain. Instead create a unique salt for each password. Hash the salt and the password, store and use that result to verify passwords.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.