Reading and interpreting information from contract storage

Question

I know that contract storage on the Ethereum blockchain is not encrypted or private in any way. All data on the blockchain is publicly viewable. Even the value of a variable declared as private can be known by sync'ing with the blockchain and reading the contract storage. My question is - how simple or complex is it to read a contract's storage data and extract some information from it, without knowing the data structures, i.e. how the data is organized?

For example, in the following partial code, (just made up some arbitrary data structure), assume there is an internal function that determines whether a particular msg.sender is allowed to access the data:

contract DataStore {

    struct Datum {
        uint8   id;
        bytes32 serialNum;
        string  name;
        uint256 createdAt;
    }

    mapping (address => Datum) private entityData; 

    function getName(address entity) public constant returns (string) {
        if (isAllowed(msg.sender) {
            return name;
        }
        else {
            return "";
        }
    } 
    ...
    ...

Would someone whose account does not have permission to access the data as per the isAllowed function, be able to extract the name that a specific address is mapped to, even if they did not know what the contract's internal data structures are? If so, how could that be done? In other words, just by looking at a contract's storage bytes, what information can be obtained and how?

I just want to get an idea of how complex this is. I know that "security by obscurity" is not a good idea, so I do not intend to rely on it in my code. Just curious.

Answer 1

The state can be retrieved (off-chain) using something like RPC interface directly against the node, but it seems to me that it's easier to simply get the transaction that set the data value (assuming it is sent in the clear). What's missing from your example is a function like

function setName(...)

I think that function would have to be present for the data to get into the contract in the first place.

That 'setter' transaction would be visible as easily as looking at http://etherscan.io for the transactions on the smart contract. If you sent the data in clear text, it would be easily retrievable.

If you sent the data into the contract in some sort of encrypted fashion, then the 'snoop' would not only be unable to see it in the transaction but neither could they see it in the state.

In answer to your direct question: yes--you can get the state data via RPC, but it's easier than that.