dedis/dela

Value contract allows overwriting arbitrary keys in store

pierluca opened this issue · 0 comments

The value contract does not prefix the keys provided by the smart contract user to store a value.
As such, a malicious user could overwrite any key/value combination in the store, including other contracts'.

This is a non-critical because the value contract is a toy contract and not used in production, but it should be addressed nonetheless.