Anyone can read the password.
Summary
Even though getPassword function has onlyOwner check and s_password variable is private, but nothing is truly private on the blockchain. Anyone can get the hex value from the storage slots of contracts and decode them.
Vulnerability Details
Value of s_password can be fetched from the respective storage slot (i.e. 1 here). So, it's not truly private.
Impact
Password is not private, anyone can get it.
Tools Used
Manual Review
Recommendations
Only one way is to store hashed value in the contract and do the hashing off-chain and then in the contract, there can be a function that takes password as param, and hashes it and returns boolean result if calculated hash and stored hash are same. If hashes are same, then password is correct, otherwise wrong.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.