Malicious users can see other user's passwords.
Summary
Malicious users can see other user's passwords.
Vulnerability Details
On the blockchain, all transactions are public and queryable. In Solidity, private merely signifies that a function can only be invoked within the contract's internal context.
Impact
Malicious users can see other people's passwords, violating the restriction in getPassword() that only allows the owner to view the password.
Tools Used
Recommendations
Smart contracts in public blockchains have no built-in mechanism to store secret data securely. It is important to protect sensitive data from reading by an untrusted actor.
You can explore more about "V3: Blockchain Data" in the SCSVS key areas.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.