Return value of getPassword function sends the clear text password which can be seen by everyone.
The function has proper access control so that only the user can call the function. Yet, from the transaction details on the blockchain, everybody is able to see the value that the getPassword function has returned, thereby revealing the secret passphrase.
Everybody is able to see the clear text password.
none
Never store a plain password string on the blockchain. Only store a salted hash of it.
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.