Private password store is not safe
Summary
Store private data on smart contracts is not safe.
Vulnerability Details
Although private variables prevent other smart contracts from accessing the stored value, it does not guarantee that the variable cannot be accessed from the outside. Web3 allows you to reach into contract storage via:
Impact
The private password will be exposed to other users.
Tools Used
Manual Review
Recommendations
To ensure that data is private, it needs to be encrypted before being put onto the blockchain. In this scenario, the decryption key should never be sent on-chain, as it will then be visible to anyone who looks for it.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.