Redundant Protocol
Summary
The protocol is redundant or rather non functional due to the technology stack of the EVM.
Vulnerability Details
All data based on Ethereum Virtual Machine is public, even if the visibility modifier for that particular variable is marked as private, as such private information, such as a password should never be stored on the EVM.
Impact
The protocol is not secure in that the structure of the code does not allow users to store passwords privately
Tools Used
Manual Review
Recommendations
I would recommend a cryptographic based storage system in which passwords are first encrypted with a secure, preferably provably secure function.
A privacy based EVM, such as the oasis protocol can also be used.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.