High02: Malicious user can easily inspect the tx to get the password via etherscan or any other tx inspection tool
Summary
Malicious user can easly inspect the tx to get the password via etherscan or any other tx inspection tool
Vulnerability Details
Public nature of the blockchain which means everyone can see the tx information via etherscan or any other tx
inspection tool password already can be seen decoded and becomes compirmised
can be inspected the password via this link
click show more and decoded output to see the password
Impact
Revealing password would make the entire contract logic useless
Tools Used
etherscan-manuel review
Recommendations
Trying different kind of cryptology methods of zk methodology to encode the password
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.