RocketDAO - personally identifiable member information (PII) stored on-chain  Acknowledged
Like a DAO user's e-mail address, PII is stored on-chain and can, therefore, be accessed by anyone. This may allow de-pseudonymize users (and correlate Ethereum addresses to user email addresses) and be used for spamming or targeted phishing campaigns putting the DAO users at risk.\\nrocketpool-go-2.5-Tokenomics/dao/trustednode/dao.go:L173-L183\\n```\\n// Return\\nreturn MemberDetails{\\n    Address: memberAddress,\\n    Exists: exists,\\n    ID: id,\\n    Email: email,\\n    JoinedBlock: joinedBlock,\\n    LastProposalBlock: lastProposalBlock,\\n    RPLBondAmount: rplBondAmount,\\n    UnbondedValidatorCount: unbondedValidatorCount,\\n}, nil\\n```\\n\\n```\\nfunction getMemberEmail(address \\_nodeAddress) override public view returns (string memory) {\\n    return getString(keccak256(abi.encodePacked(daoNameSpace, "member.email", \\_nodeAddress))); \\n}\\n```\\n
Avoid storing PII on-chain where it is readily available for anyone.
```\\n// Return\\nreturn MemberDetails{\\n    Address: memberAddress,\\n    Exists: exists,\\n    ID: id,\\n    Email: email,\\n    JoinedBlock: joinedBlock,\\n    LastProposalBlock: lastProposalBlock,\\n    RPLBondAmount: rplBondAmount,\\n    UnbondedValidatorCount: unbondedValidatorCount,\\n}, nil\\n```\\n