Nothing is private on the blockchain
Summary
The purpose of the contract is to "store a private password that others won't be able to see", but this is fundamentally flawed logic because nothing is private on the blockchain.
Vulnerability Details
When the owner calls setPassword(), this function call will be visible in the mempool and everyone will be able to see the argument parsed into the function, therefore everyone will be able to know the password.
Impact
The owner thinks that his password is privately stored in the contract, when in fact it is public information.
Tools Used
Manual review
Recommendations
Don't use a public blockchain to store private information.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.