setPassword function parameter is clear text
Summary
The function parameter to the setPassword function is readable by everyone because it is transmitted as plain text
Vulnerability Details
The password string is transmitted as clear text, so everybody can see the parameter with which the setPassword function was called.
Impact
The password is not safe when it is transmitted as clear text. Everybody is able to retrieve it from the blockchain.
Tools Used
none
Recommendations
Passwords should always be stored as hashes, using a salt for extra security. The blockchain is transparent so everybody will be able to retrieve what values are stored in it. So use a safe way to create a hash from your password, and don't send the plain-text password to the contract.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.