Submission Details
Severity:
Password can be read by anyone
Summary
Regular users can read the password of the blockchain by viewing storage slots
Vulnerability Details
address private s_owner;
string private s_password;
const contents = await web3.eth.getStorageAt(contractAddress, storageSlotNumber)
Impact
sensitive data is not secure and will be known by everyone(data breach)
Tools Used
manual audit
Recommendations
Dont store sensitive data on the blockchain
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.