Submission Details
Severity:
Anyone can read the owner's password
Summary
Anyone can read the private state variable s_password.
Vulnerability details
s_password is defined with a private visibility but this does not mean that the variable is private and that no one can access it. The variable is accessible through the contract storage.
Impact
This way, anyone can read the owner's password.
Recommendations
One solution is to encrypt the password off-chain and store the encrypted password on-chain.
Updates
Lead Judging Commences
inallhonesty
almost 2 years ago
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.