<h1><strong>Private variables on EVM blockchains are not really private and hidden</strong></h1>
<ul>
<li>Do you think storing important keys and data in private key’s are safer on EVM chains. Definition say’s all, EVM is an transparent chain</li>
<li><strong>Attackers</strong> will always looks for deployed contract addresses of contracts that are vulnerable and contains funds</li>
<li>marking a variable as <strong>private</strong> only prevents other contracts from accessing it.</li>
<li>State variables marked as <strong>private and local variables are still publicly accessible</strong></li>
</ul>
<h1><strong>Simple contract scenario</strong></h1>
<ul>
<li>The given contract stores <code>password</code> on-chain and it is marked as <code>private variable</code></li>
</ul>
<pre><code class="language-js">contract <span class="hljs-title class_">Vault</span> {
        bool public locked;
@&gt;  bytes32 private password;

    <span class="hljs-title function_">constructor</span>(<span class="hljs-params">bytes32 _password</span>) {
        locked = <span class="hljs-literal">true</span>;
        password = _password;
    }
    <span class="hljs-keyword">function</span> <span class="hljs-title function_">unlock</span>(<span class="hljs-params">bytes32 _password</span>) public {
        <span class="hljs-keyword">if</span> (password == _password) {
            locked = <span class="hljs-literal">false</span>;
        }
    } 
}
</code></pre>
<ul>
<li>Above Contract stored password inside an private variable, thinking that it’s safer and no one can access it!!!</li>
</ul>
<h1><strong>Simple way to access private and public data of deployed contracts</strong></h1>
<ul>
<li>With the help of <code>contract addess</code> and <code>storage layout</code>, attackers can easily read the data from private and public data stored on-chain</li>
</ul>
<ol>
<li><strong>Through cast commands</strong>:</li>
</ol>
<ul>
<li>Dev’s using foundry can use <code>cast commands</code> to access storage layout of any contract using below commands.</li>
</ul>
<pre><code class="language-sh">cast storage --rpc-url <span class="hljs-variable">$SEPOLIA_RPC_URL</span> --etherscan-api-key <span class="hljs-variable">$ETHERSCAN_API_KEY</span> CONTRACT_ADDRESS SLOT_NUMBER
</code></pre>
<ul>
<li>This command can be used to easily read private variables stored on-chain</li>
</ul>
<ol start="2">
<li><strong>Through Etherscan</strong>:</li>
</ol>
<ul>
<li>
<p>Go to <code>Etherscan</code> and search for <code>contract address</code></p>
</li>
<li>
<p><strong>Copy and explore the <code>TNX hash from internal transactions</code></strong></p>
</li>
</ul>
<p><img src="https://media.daily.dev/image/upload/s--W-mGbgQO--/f_auto/v1751011833/ugc/content_48f9ce4e-872f-40c6-8243-e9dcffcce0e2?_a=BAMClqZW0" alt="PRIVATE-DATA-1"></p>
<ul>
<li><strong>Go for <code>state</code> and look for all <code>storage value</code> present!!!</strong></li>
</ul>
<p><img src="https://media.daily.dev/image/upload/s--zu3-liw0--/f_auto/v1751011864/ugc/content_bb67d3b1-b31b-4f4d-9fcc-78ac559a7f56?_a=BAMClqZW0" alt="PRIVATE-DATA-2"></p>
<p><img src="https://media.daily.dev/image/upload/s--3Uttqpoc--/f_auto/v1751011870/ugc/content_a86d4e88-5a7a-40de-8723-acc06926d127?_a=BAMClqZW0" alt="PRIVATE-DATA-3"></p>
<h1>Try this CTF to gain more understanding</h1>
<ul>
<li><a href="https://ethernaut.openzeppelin.com/level/8" target="_blank" rel="noopener nofollow">https://ethernaut.openzeppelin.com/level/8</a></li>
</ul>
<h1>Real time case studies you want to look</h1>
<ul>
<li><a href="https://blog.ethereum.org/2016/12/05/zksnarks-in-a-nutshell" target="_blank" rel="noopener nofollow">https://blog.ethereum.org/2016/12/05/zksnarks-in-a-nutshell</a></li>
</ul>
<h3>So be aware of what you are storing on-chain and how you are enabling attackers to explore your contract and drains out all funds</h3>
<p>#blockchain #smart-contract #ethereum #security</p>


An independent squad focused on Ethereum blockchain development and the Web3 ecosystem. We'll explore and understand Solidity smart contracts and dive into tools like Web3.js, Truffle, Ganache, Hardhat, and Foundry-Forge.

Ethereum BlockChain Development

Private variables in Ethereum smart contracts are not truly private and can be accessed by anyone. The EVM's transparent nature means that marking variables as 'private' only prevents other contracts from accessing them, but the data remains publicly readable on-chain. Attackers can exploit this by using tools like cast commands or Etherscan to read storage layouts and extract sensitive information like passwords or keys from deployed contracts.

#1: Private variables are not really private on EVM