First Flight #1: PasswordStore

Summary

It's possible to monitor getPassword() function from the blockchain nodes.

Vulnerability Details

When the getPassword() function is called, no change is done on the blockchain and thus it's not possible to monitor/catch the return value -in our case the password- from the blockchain. However it's possible to monitor it from the nodes.

Impact

After the contract is deployed and the initial password("myPassword") is set we can send below command to the contract:
cast call 0x5fbdb2315678afecb367f032d93f642f64180aa3 "getPassword()" --rpc-url http:127.0.0.1:8545 --private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80

0x5fbdb2315678afecb367f032d93f642f64180aa3 is the contract address followed by the function we want to call. Anvil rpc-url and the private key which we used during the deployment of the contract. Although getPassword() is a getter function we have to provide the private-key. Otherwise it will be reverted due to the if statement which prevents to call the function anyone who is not the contract owner. Contract owner is set during the deployment with the help of constructor function.

Below is the value we receive as an output to our cast call command:

0x0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a6d7950617373776f726400000000000000000000000000000000000000000000

the third 32 bytes is the password encoded as hex: 6d7950617373776f726400000000000000000000000000000000000000000000

cast to-ascii 6d7950617373776f7264 command output will be the ascii value of the password as stored in our contract.
myPassword

Although getPassword() function can be called by only the owner and the return value will be seen by the owner of the contract, eth_call can be monitored on the Ethereum nodes.

Tools Used

• Manual auditing

• Foundry

Recommendations

Don't store passwords or any sensitive data on the blockchain. Limiting the usage of function calls to specific users will not hide the output of the function from anyone.