Submission Details
Severity:
Unsecured Password Storage on Public Blockchain
Summary
Passwords are stored on-chain in clear text, making them publicly accessible.
Vulnerability Details
The PasswordStore contract saves passwords on the Ethereum blockchain. Despite using the private access modifier, Ethereum's inherent transparency allows anyone to access the data directly from the contract's state.
Impact
Public exposure of stored passwords.
Tools Used
Manual Review
Recommendations
Avoid direct on-chain storage for sensitive data.
Updates
Lead Judging Commences
inallhonesty
almost 2 years ago
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.