No data is private on the blockchain
Summary
Everyone is able to read the password.
Vulnerability Details
The PasswordStore.sol is intended to be used as a password manager for the owner. However, on the blockchain everything is public. string private s_password; means that the password is not exposed to the public ABI of the contract. That's it. It does not protect anyone from reading it.
Impact
The whole contract loses it purpose.
Tools Used
Manual Review
Recommendations
Do not store passwords in smart contracts.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.