Anyone can see what the password is
Summary
Just because a variable on a smart contract is labeled private it does not mean it can't be accessed. Someone can simply look at the storage slots of the deployed PasswordStore.sol contract and get the password.
Vulnerability Details
to illustrate this vulnerability first we can run make anvil to create a blockchain locally.
then on a new terminal we can deploy the contract using make deploy then run cast storage "contract address"
the last command will output the following:
As it can be seen by the table above a value is given for the s_password variable, converting that into hexadecimal we get: 6D7950617373776F7264 and then converting that into a string we get: myPassword
Impact
This issue has been listed as High, since anyone can see the value of s_password
Tools Used
Foundry & Manual Review
Recommendations
Store your password off-chain. Nothing on the blockchain is private.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.