Password is readable readable from contract; saving private data on-chain does not guarantee privacy on EVM chains
Summary
There is no concept of private data on-chain on any EVM compatible chains. As such saving the password on-chain:
https://github.com/Cyfrin/2023-10-PasswordStore/blob/7a2fc760235c4f4809511186ff9a061c2ec68634/src/PasswordStore.sol#L22-L29
will make it accessible to anyone who reads the contract storage directly, example using dedaubto view the storage of 0xf7ab6d94ddda3ebe6362ff4ad503a4b61d545639:
https://library.dedaub.com/ethereum/address/0xf7ab6d94ddda3ebe6362ff4ad503a4b61d545639/source?storage=true
Impact
Password would be visible for all.
Tools Used
Manual review
Recommendations
Fundamentally change the logic of the project, do not save private data online.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.