storage variable reveals stored password string
Summary
The password string is stored as plain text in the s_password storage variable.
Vulnerability Details
The storage variable s_password is readable
Impact
Everybody can retrieve the password. The information stored in a private variable is only safe from other contracts accessing and modifying the value of the variable. But it is still visible to the world outside of the blockchain, and therefore not suited for storing a plaintext password string.
Tools Used
none
Recommendations
Never store the password as plain text. Only ever store the salted hash of the password.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.