Plaintext equivalent password
Summary
Suppose only owner can know/read the password. String variable are readable no matter it is public or private variable.
Vulnerability Details
The variable s_password declare as private to prevent direct read from contract. However, the value is still readable from storage state or calldata, it mean that the password is nearly no different with a plaintext password.
Impact
Anyone can access and use the s_password
Recommendations
Encrypt and store only the encrypted string, the decryption key should store safely off-chain.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.