Your smart contract has a small vulnerabilities you can not see.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;
contract SimpleStorage {
string private storedValue;
event ValueChanged(string newValue);
// Function to set the value
function setValue(string calldata newValue) external {
storedValue = newValue;
emit ValueChanged(newValue);
}
// Function to get the value
function getValue() external view returns (string memory) {
return storedValue;
}
}
The SimpleStorage
contract you provided is quite straightforward and minimal. However, even simple contracts can have potential vulnerabilities or issues. Here are some areas to consider:
1. Public Visibility of Storage Data
Even though the storedValue
variable is private, it doesn't mean it is completely hidden. Since the Ethereum blockchain is transparent, anyone can potentially read the value of storedValue
directly from the blockchain data.
2. Lack of Access Control
The setValue
function is public and can be called by anyone. This might be fine for some use cases, but if you want to restrict who can update the stored value, you should add access control.
3. Gas Costs and Efficiency
The contract uses a string to store data, which can be more expensive in terms of gas compared to other types of data storage. If you're storing large strings frequently, this can become costly.
4. No Input Validation
There is no validation on the input for the setValue
function. While this might not be a critical issue for simple data, it can become a problem if you have specific requirements for the data being stored.
5. Reentrancy
While this contract does not appear vulnerable to reentrancy attacks due to its simplicity and lack of external calls within state-changing functions, it is a good practice to keep this in mind for more complex contracts.
Suggested Improvements
Here are some improvements you might consider:
1. Access Control
If you want to restrict who can set the value, you can use the Ownable
pattern from OpenZeppelin.
solidityCopy code// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;
import "@openzeppelin/contracts/access/Ownable.sol";
contract SimpleStorage is Ownable {
string private storedValue;
event ValueChanged(string newValue);
// Function to set the value, only callable by the owner
function setValue(string calldata newValue) external onlyOwner {
storedValue = newValue;
emit ValueChanged(newValue);
}
// Function to get the value
function getValue() external view returns (string memory) {
return storedValue;
}
}
2. Input Validation
You can add some basic input validation to ensure the value being set meets certain criteria.
solidityCopy code// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;
contract SimpleStorage {
string private storedValue;
event ValueChanged(string newValue);
// Function to set the value with basic input validation
function setValue(string calldata newValue) external {
require(bytes(newValue).length > 0, "Value must not be empty");
storedValue = newValue;
emit ValueChanged(newValue);
}
// Function to get the value
function getValue() external view returns (string memory) {
return storedValue;
}
}
Summary
Your contract is simple and generally safe, but consider adding access control and input validation if appropriate for your use case. Always keep security in mind, even for simple contracts, as small vulnerabilities can lead to significant issues when deployed on the blockchain.
Subscribe to my newsletter
Read articles from Magda Jankowska directly inside your inbox. Subscribe to the newsletter, and don't miss out.
Written by
Magda Jankowska
Magda Jankowska
Security Researcher for Web3 and Dark Web Bug hunter Ethical Hacker