Unsecure private data storing that can be used to take protocol control
Summary
Password considered to be private is stored in public
Vulnerability Details
Access to password allows to change it and take control over the protocol. However password is stored on blockchain and anyone can access it by reading contract slots and therefore change it
Impact
Attacker can reveal password and take control over the protocol
Tools Used
Recommendations
Reorganise auth architecture. Consider to use safe governance or signatures for authentication
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.