Passwords stored as string are not secure.
Summary
Store the passwords in the form of hash (rather than strings) to make it secure.
Vulnerability Details
The state variable 's_password' which stores the passwords are being stored as strings , which are not secure, and might easily be read.
Impact
anyone might be able to crack your password easily if it is stored in the form of a plaintext /strings.
Tools Used
manual analysis
Recommendations
Store in your contract hashed values of these passwords(s_passwords) using keccak256 algorithm .you may do so with javascript library Remember to hash them off-chain and send final values to the contract.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.