setPassword()'s stored data can be read by anyone
Summary
The PasswordStore::setPassword() function stores data that can be read by anyone.
Vulnerability Details
The data (the owner's password) is stored in a non-encrypted manner. It makes it readable by anyone with, for example getStorageAt.
Impact
The password, which is supposed to be secret and known to the owner only, can be read, understood and used by anyone.
Tools Used
VS Code.
Recommendations
-
Encrypt the password and store it on-chain.
Though this option implies decrypting the password with off-chain computation. -
For a really secure solution, store the password off-chain.
Though this option would nullify the contract's purpose.
Key take-away: basically, it is not safe to store sensitive data on-chain.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.