--- title: #1: Private variables are not really private on EVM description: Private variables in Ethereum smart contracts are not truly private and can be accessed by anyone. The EVM's transparent nature means that marking variables as... canonical: https://daily.dev/posts/1-private-variables-are-not-really-private-on-evm-ee05sqlxw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: #1: Private variables are not really private on EVM | daily.dev og:description: Private variables in Ethereum smart contracts are not truly private and can be accessed by anyone. The EVM's transparent nature means that marking variables as... og:url: https://daily.dev/posts/1-private-variables-are-not-really-private-on-evm-ee05sqlxw og:image: https://api.daily.dev/og/posts/eE05sQlXW.png og:image:alt: #1: Private variables are not really private on EVM og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # #1: Private variables are not really private on EVM **[Ethereum BlockChain Development](https://daily.dev/sources/anuragiiitt)** · [@abiencodepacked](https://daily.dev/abiencodepacked) · 2 min read · 5 upvotes · 0 comments ## Summary Private variables in Ethereum smart contracts are not truly private and can be accessed by anyone. The EVM's transparent nature means that marking variables as 'private' only prevents other contracts from accessing them, but the data remains publicly readable on-chain. Attackers can exploit this by using tools like cast commands or Etherscan to read storage layouts and extract sensitive information like passwords or keys from deployed contracts. ## Content # **Private variables on EVM blockchains are not really private and hidden** - Do you think storing important keys and data in private key's are safer on EVM chains. Definition say's all, EVM is an transparent chain - **Attackers** will always looks for deployed contract addresses of contracts that are vulnerable and contains funds - marking a variable as **private** only prevents other contracts from accessing it. - State variables marked as **private and local variables are still publicly accessible** # **Simple contract scenario** - The given contract stores `password` on-chain and it is marked as `private variable` ```js contract Vault { bool public locked; @> bytes32 private password; constructor(bytes32 _password) { locked = true; password = _password; } function unlock(bytes32 _password) public { if (password == _password) { locked = false; } } } ``` - Above Contract stored password inside an private variable, thinking that it's safer and no one can access it!!! # **Simple way to access private and public data of deployed contracts** - With the help of `contract addess` and `storage layout`, attackers can easily read the data from private and public data stored on-chain 1. **Through cast commands**: - Dev's using foundry can use `cast commands` to access storage layout of any contract using below commands. ```sh cast storage --rpc-url $SEPOLIA_RPC_URL --etherscan-api-key $ETHERSCAN_API_KEY CONTRACT_ADDRESS SLOT_NUMBER ``` - This command can be used to easily read private variables stored on-chain 2. **Through Etherscan**: - Go to `Etherscan` and search for `contract address` - **Copy and explore the `TNX hash from internal transactions`**  - **Go for `state` and look for all `storage value` present!!!**   # Try this CTF to gain more understanding - https://ethernaut.openzeppelin.com/level/8 # Real time case studies you want to look - https://blog.ethereum.org/2016/12/05/zksnarks-in-a-nutshell ### So be aware of what you are storing on-chain and how you are enabling attackers to explore your contract and drains out all funds #blockchain #smart-contract #ethereum #security --- Tags: [#ethereum](https://daily.dev/tags/ethereum), [#smart-contracts](https://daily.dev/tags/smart-contracts), [#solidity](https://daily.dev/tags/solidity), [#evm](https://daily.dev/tags/evm) [View this post on daily.dev](https://daily.dev/posts/1-private-variables-are-not-really-private-on-evm-ee05sqlxw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/1-private-variables-are-not-really-private-on-evm-ee05sqlxw","headline":"#1: Private variables are not really private on EVM","text":"Private variables in Ethereum smart contracts are not truly private and can be accessed by anyone. The EVM's transparent nature means that marking variables as 'private' only prevents other contracts from accessing them, but the data remains publicly readable on-chain. Attackers can exploit this by using tools like cast commands or Etherscan to read storage layouts and extract sensitive information like passwords or keys from deployed contracts.","url":"https://daily.dev/posts/1-private-variables-are-not-really-private-on-evm-ee05sqlxw","datePublished":"2025-06-27T08:16:11.906Z","dateModified":"2025-06-27T08:16:32.112Z","author":{"@type":"Person","name":"Anurag Shingare","url":"https://daily.dev/abiencodepacked","image":"https://media.daily.dev/image/upload/s--pLWLGNO0--/f_auto/v1735198145/avatars/avatar_HWlqjvZSl79rCUSk3LxVQ","description":"Web3 and Ethereum BlockChain | Nextjs | Solidity | Hardhat | Foundry | GenAI application |Typescript","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":30}},"image":"https://media.daily.dev/image/upload/s--ZDSa9TUT--/f_auto/v1751012172/posts/eE05sQlXW?_a=BAMClqZW0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/anuragiiitt","name":"Ethereum BlockChain Development"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ethereum BlockChain Development","item":"https://daily.dev/squads/anuragiiitt"},{"@type":"ListItem","position":3,"name":"#1: Private variables are not really private on EVM"}]} ```