Anyone can view passwords by decode storage slot
Summary
Anyone can view passwords by decode storage slot
Vulnerability Details
This private variable only limits the access from external contract
But anyone can read the blockchain storage at that variable's slot
and decode to get the password value
Impact
Make password disclosure for anyone
POC
cast storage [options] address slot
The string password variable is in slot 1
Tools Used
foundry cast
Recommendations
Don't store sensitive information on the blockchain.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.