5

I have read many times that sensitive data should never be stored in a transaction, but, specifically, how would the value of a state variable be read if marked private?

1

2 Answers 2

8

For the example contract you gave, it looks like there's a bytes32 state variable at slot 1 with the value "A very strong secret password :)".

I found this by just calling getStorageAt a couple times:

> web3.eth.getStorageAt('0x6260319bcbcbf33f84397ae0000e49b0f50ee075', 0, (e, v) => console.log(v))
0x0000000000000000000000000000000000000000000000000000000000000001
> web3.eth.getStorageAt('0x6260319bcbcbf33f84397ae0000e49b0f50ee075', 1, (e, v) => console.log(v))
0x412076657279207374726f6e67207365637265742070617373776f7264203a29
> web3.eth.getStorageAt('0x6260319bcbcbf33f84397ae0000e49b0f50ee075', 1, (e, v) => console.log(web3.toAscii(v)));
A very strong secret password :)

If we had the source code for the contract, this would be much easier. And if the contract were obfuscated, this would be somewhat harder.

But the bottom line is that everything on the blockchain (including private state variables) is public.

3
  • Interesting. Nice work! Apr 5, 2018 at 20:59
  • @smarx do the > marks indicate you're using geth for that? I can't get an attached console session to take js (coffeescript?) like that
    – nipponese
    Apr 5, 2018 at 23:47
  • I was doing this in Chrome. Not sure what version of JavaScript geth supports, but it probably doesn't like the lambda syntax. In geth, no need for a callback anyway. Just web3.eth.getStorageAt('<address>', 1) should work.
    – user19510
    Apr 5, 2018 at 23:50
0

Any contract code deployed to the blockchain can be read/viewed by anyone. This includes variables/functions declared private The only thing private does is restrict access of that variable/function to the contract it is declared within.

From the docs:enter image description here

5
  • My question is asking for someone to show the steps for viewing the an arbitrary state variable marked private.
    – nipponese
    Apr 5, 2018 at 20:20
  • In this case, you would need to view the contract code/ABI on etherscan, and determine the value of the variable on your own. Apr 5, 2018 at 20:26
  • So for example, ropsten.etherscan.io/address/… if there's no ABI shown, the string data is not readable?
    – nipponese
    Apr 5, 2018 at 20:33
  • This question is a possible duplicate of ethereum.stackexchange.com/questions/188/…. With no contract code/ABI, I don't believe it is possible to recover specific values using only opcodes/bytecode (especially if the code was compiled using the optimizer). Apr 5, 2018 at 20:46
  • 1
    It is of course possible, though the difficulty goes up. (See my answer for how easy this particular contract is.)
    – user19510
    Apr 5, 2018 at 20:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.