The password stored in the slot is not secure.
Summary
The password stored in the slot is not secure.
Vulnerability Details
The data stored in the slot can be obtained by checking the slot, And the input values and return values of the function can also be obtained by decoding the on-chain data. So no matter what method is used, directly storing passwords on the blockchain is not secure.
Impact
See Vulnerability Details.
Tools Used
Manual review.
Recommendations
If you need to store passwords on the chain, you can store encrypted data on the chain and decrypt it off-chain.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.