Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Sensitive Teacher Address Information Publicly Exposed

mimis

Summary

All teacher addresses are publicly viewable, creating privacy concerns and potential security risks.

Vulnerability Details

Root cause:

function getListOfTeachers() external view returns (address[] memory) {
return listOfTeachers;
}

Initial State:

  • Teacher addresses stored in public array

  • No access control on viewing addresses

Step 1: Anyone can call getListOfTeachers()
Step 2: Complete list of teacher addresses exposed
Step 3: Addresses can be tracked and targeted

Implications:

  • Privacy concerns for teachers

  • Potential for targeted attacks

  • Social engineering risks

Impact

  • Teacher privacy compromised

  • Increased risk of phishing attacks

  • Potential for targeted social engineering

Tools Used

Manual Review

Recommendations

Implement role-based access:

function getListOfTeachers() external view onlyPrincipal returns (address[] memory) {
return listOfTeachers;
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.