Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

getPassword function transmits clear text password string

Summary

Return value of getPassword function sends the clear text password which can be seen by everyone.

Vulnerability Details

The function has proper access control so that only the user can call the function. Yet, from the transaction details on the blockchain, everybody is able to see the value that the getPassword function has returned, thereby revealing the secret passphrase.

Impact

Everybody is able to see the clear text password.

Tools Used

none

Recommendations

Never store a plain password string on the blockchain. Only store a salted hash of it.

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-read-storage

Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.