Submission Details
Severity:
03-`s_password`, even if set to `privte`, may still cause sensitive data leakage.
Summary
State variables (private) in a contract only limit their invocation scope and remain accessible on the chain. Referable study material: Ethernaut Level 12 - Privacy
Impact
The sensitive data of s_password will be accessed in the chain and will lead to sensitive data leakage!
Tools Used
Manual Review
Recommendations
Do not store any sensitive data in the contract, as any data in the contract can be accessed.
Updates
Lead Judging Commences
inallhonesty
almost 2 years ago
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.