Your smart contract has a small vulnerabilities you can not see.

Magda JankowskaMagda Jankowska
3 min read

// SPDX-License-Identifier: MIT 
pragma solidity ^0.8.13; 

contract SimpleStorage { 
string private storedValue; 

event ValueChanged(string newValue); 

 // Function to set the value
    function setValue(string calldata newValue) external {
        storedValue = newValue;
        emit ValueChanged(newValue);
    }
    // Function to get the value
    function getValue() external view returns (string memory) {
        return storedValue;
    }
}

The SimpleStorage contract you provided is quite straightforward and minimal. However, even simple contracts can have potential vulnerabilities or issues. Here are some areas to consider:

1. Public Visibility of Storage Data

Even though the storedValue variable is private, it doesn't mean it is completely hidden. Since the Ethereum blockchain is transparent, anyone can potentially read the value of storedValue directly from the blockchain data.

2. Lack of Access Control

The setValue function is public and can be called by anyone. This might be fine for some use cases, but if you want to restrict who can update the stored value, you should add access control.

3. Gas Costs and Efficiency

The contract uses a string to store data, which can be more expensive in terms of gas compared to other types of data storage. If you're storing large strings frequently, this can become costly.

4. No Input Validation

There is no validation on the input for the setValue function. While this might not be a critical issue for simple data, it can become a problem if you have specific requirements for the data being stored.

5. Reentrancy

While this contract does not appear vulnerable to reentrancy attacks due to its simplicity and lack of external calls within state-changing functions, it is a good practice to keep this in mind for more complex contracts.

Suggested Improvements

Here are some improvements you might consider:

1. Access Control

If you want to restrict who can set the value, you can use the Ownable pattern from OpenZeppelin.

solidityCopy code// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

import "@openzeppelin/contracts/access/Ownable.sol";

contract SimpleStorage is Ownable {
    string private storedValue;

    event ValueChanged(string newValue);

    // Function to set the value, only callable by the owner
    function setValue(string calldata newValue) external onlyOwner {
        storedValue = newValue;
        emit ValueChanged(newValue);
    }

    // Function to get the value
    function getValue() external view returns (string memory) {
        return storedValue;
    }
}

2. Input Validation

You can add some basic input validation to ensure the value being set meets certain criteria.

solidityCopy code// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

contract SimpleStorage {
    string private storedValue;

    event ValueChanged(string newValue);

    // Function to set the value with basic input validation
    function setValue(string calldata newValue) external {
        require(bytes(newValue).length > 0, "Value must not be empty");
        storedValue = newValue;
        emit ValueChanged(newValue);
    }

    // Function to get the value
    function getValue() external view returns (string memory) {
        return storedValue;
    }
}

Summary

Your contract is simple and generally safe, but consider adding access control and input validation if appropriate for your use case. Always keep security in mind, even for simple contracts, as small vulnerabilities can lead to significant issues when deployed on the blockchain.

0
Subscribe to my newsletter

Read articles from Magda Jankowska directly inside your inbox. Subscribe to the newsletter, and don't miss out.

Written by

Magda Jankowska
Magda Jankowska

Security Researcher for Web3 and Dark Web Bug hunter Ethical Hacker