# Add VIP: Private State Variable Visibility Exposure
**URL:** https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84
**Category:** VIPs
**Created:** [December 6, 2023, 5:32pm UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84 "2023-12-06T17:32:33Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@tom](https://vechain.discourse.group/u/tom)
#### Post date: [December 6, 2023, 5:32pm UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/1 "2023-12-06T17:32:33Z")
This informational VIP aims to address a divergence from Ethereum’s state variable visibility in the VechainThor Blockchain, where the Prototype builtin contract allows unrestricted access to the private and internal storage of all contracts, potentially leading to contract vulnerabilities.
This has been documented by the community at the link below, however, this VIP would put it in a more official notice for vechain developers.
[https://docs.vechain.energy/Vechain/Develop-with/Common-Pitfalls/BuiltIn-Storage-Access/](https://docs.vechain.energy/Vechain/Develop-with/Common-Pitfalls/BuiltIn-Storage-Access/)
PR: [https://github.com/vechain/VIPs/pull/55](https://github.com/vechain/VIPs/pull/55)
---
### Author:  [@brettski](https://vechain.discourse.group/u/brettski)
#### Post date: [December 6, 2023, 8:37pm UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/2 "2023-12-06T20:37:42Z")
Certainly something to look into.
---
### Author:  [@brettski](https://vechain.discourse.group/u/brettski)
#### Post date: [December 14, 2023, 2:29pm UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/3 "2023-12-14T14:29:15Z")
Hey @tom, so I spoke with the devs on this one.
In summary no fields in a contract are really `private`. The term `private` just means that there is no setter or getter functions outside of the contract. Data is always visible on the blockchain unless it is encrypted.
A useful [stackexchange](https://ethereum.stackexchange.com/questions/79603/what-are-private-variables-in-solidity/79604#79604) source.
---
### Author:  [@tom](https://vechain.discourse.group/u/tom)
#### Post date: [December 15, 2023, 7:42am UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/4 "2023-12-15T07:42:56Z")
@brettski, does this warning in the solidity docs hold true on vechain? Specifically the part about other contracts not being able to read `private` or `internal` information.
> Making something `private` or `internal` only prevents other contracts from reading or modifying the information, but it will still be visible to the whole world outside of the blockchain.
If it does not, would this then not be something smart contract developers and auditors should be aware of?
[https://docs.soliditylang.org/en/latest/contracts.html#index-3](https://docs.soliditylang.org/en/latest/contracts.html#index-3)
---
### Author:  [@tom](https://vechain.discourse.group/u/tom)
#### Post date: [December 17, 2023, 5:22am UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/5 "2023-12-17T05:22:52Z")
I’ve been curious about whether the built-in contracts have undergone 3rd party audits. Currently, I’m aware of the audits for the [Thor Node contract](https://cer.live/cryptocurrency-security-ratings/vechain) and the [MaaS contracts](https://hacken.io/audits/vechain/).
If these haven’t been audited yet, is it possible for vechain to consider a 3rd party audit on the built-in contracts and their core integration? Without this I believe it could potentially prevent adoption from developers from other chains building on vechain.
---
### Author:  [@libotony](https://vechain.discourse.group/u/libotony)
#### Post date: [December 18, 2023, 9:06am UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/6 "2023-12-18T09:06:42Z")
Hi @tom, if you take a look at the API `GET /accounts/{address}/storage/{key}`, `storageFor` brings the API ability to EVM which we consider it’s an extension or I would call a ‘feature’. Also, there is no secret on the blockchain(except for the blockchain with privacy as the feature) until it’s encrypted.
---
### Author:  [@libotony](https://vechain.discourse.group/u/libotony)
#### Post date: [December 18, 2023, 9:16am UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/7 "2023-12-18T09:16:27Z")
Solidity compiler does its job, `private` and `internal` variable won’t be accessed by other contracts since they won’t generate get function for the variables. `storageFor` kind of breaks this commitment.However, so-called ‘private’ variable can be accessed outside of EVM with the blockchain client’s API `eth_getStorageAt`(or `GET /accounts/{address}/storage/{key}` ). So I would suggest adding document for this feature and always give developer the hint that no secret on blockchain.
---
### Author:  [@brettski](https://vechain.discourse.group/u/brettski)
#### Post date: [January 8, 2024, 12:16pm UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/8 "2024-01-08T12:16:51Z")
Hey @tom any further thoughts on this given @libotony’s latest message?
---
### Author:  [@tom](https://vechain.discourse.group/u/tom)
#### Post date: [July 25, 2024, 1:23pm UTC](https://vechain.discourse.group/t/add-vip-private-state-variable-visibility-exposure/84/9 "2024-07-25T13:23:27Z")
> So I would suggest adding document for this feature and always give developer the hint that no secret on blockchain.
I think this is a good move forward.