Submission Details
Severity:
Soulmate::readMessageInSharedSpace Anyone can read in a shared space on the blockchain, even without the same NFT ID
Summary
Anyone can read in a shared space on the blockchain, even without the same NFT ID, because all data on a smart contract can be read.
Vulnerability Details
Add this test to SoulmateTest.t.sol and run forge test --match-test test_WithoutSameIDReadMeassage -vvvv to validate the issue
function test_WithoutSameIDReadMeassage() public {
_mintOneTokenForBothSoulmates();
test_WriteAndReadSharedSpace();
uint256 sharedSpaceSolt = 15;
uint256 key = 0;
bytes32 slot = keccak256(abi.encodePacked(key, sharedSpaceSolt));
bytes13 messageBytes = bytes13(vm.load(address(soulmateContract), slot));
string memory wroteMessage = "Buy some eggs";
string memory readMessage = string(abi.encodePacked(messageBytes));
assertTrue(compare(wroteMessage, readMessage));
}
Impact
So anyone can read the messages between the couples.
Tools Used
Manual review
Recommendations
Locally encrypted messages
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.