Nothing is private in blockchain
Summary
The restriction that only allow msg.sender to read password can be bypass using javascript
Vulnerability Details
Nothing is private in blockchain including slot in storage so using javascript like web3.eth.getStorageAt(contractAddress, slotNumber) we can read any data in storage.
In this case slotNumber is 1 as address private s_owner; is slot 0 and string allocate a new slot
Impact
Anyone can read the password of contract owner
Tools Used
VSCode
Recommendations
Don't do this kind of things , a blockchain is not a password vault ..
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.