Anyone can see the password by the `Etherscan or other block explorer (like polygonscan)`
Summary
Anyone can see the password by the Etherscan or other block explorer (like polygonscan) transaction history. This is link of transaction
Vulnerability Details
Go to this link and follow the steps below.
Click on the
+ Click to show More.Go to Input Data section.
Click on the
Decode Input Databutton.
here you can see the password and you are not owner .
Impact
Anyone can see the password without interacting with the contract.
Tools Used
foundry
etherscan
Recommendations
we can take
encrypted passwordas the parameter of the setpassword function which can only decrypted by the owner private key.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.