unencrypted-private-data-on-chain

The private modifier in Solidity smart contracts only restricts access from other contracts, but all on-chain data remains publicly readable. This Skill analyzes state variables and transaction calldata to detect sensitive information exposed in unencrypted on-chain storage.

To securely store private data on-chain, use cryptographic patterns like commit-reveal schemes or keep sensitive information in off-chain storage. This Skill detects unencrypted private data vulnerabilities and recommends secure remediation strategies for confidentiality.

Storing passwords or private keys in smart contract state variables exposes them publicly because blockchain data is accessible to anyone. This Skill identifies insecure data storage in contract state and transaction calldata, highlighting these critical security vulnerabilities.

Implementing a commit-reveal scheme involves submitting a cryptographic hash of sensitive data first, then revealing the actual data later. This Skill guides developers toward using commit-reveal mechanisms and off-chain storage as secure alternatives to unencrypted on-chain storage.

Yes, transaction calldata can expose sensitive information because it is publicly visible on the blockchain before execution. This Skill analyzes transaction calldata for sensitive information to detect and mitigate the risk of unencrypted private data transmission.