Password isn't private
Summary
The password is stored on the blockchain, even if the variable is private, anyone can read the value of the slot associated and get the value of Password.
Vulnerability Details
Variable stored in storage even private one, are readable by arbitrary reading the slot associated.
Impact
Anyone can have the password and then spoof the initial user.
Tools Used
Foundry
cast storage addr SC
Recommendations
Don't stored any password or sensible data on the blockchain.
Even attribute given in function input aren't private.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.