Public passwords
Summary
Passwords can be read from off-chain
Vulnerability Details
As stated in the doc-strings of the contract, the intention is that nobody should be able to read the password of a user, as it is private. Although private variables can't be read by other contracts, they can be read from offchain by looking at the specific storage location where they are. So, this makes the passwords public, and not private, as per intended.
Impact
It makes the app unusable, as it defies one of the two main requirements (passwords should be only accessed by the owner).
Tools Used
Recommendations
Never store private information in a contract. If any, store proofs or hashed passwords.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.