Users Password can be Obtained by Non Owners
Summary
Users password can be found by non owners
Vulnerability Details
s_password is a private variable. Private variables cannot be accessed by other contracts but can still be read on the blockchain, ie introspecting the block/transaction it was set.
Impact
users password is NOT secure and can be compromised, potentially leading to loss of funds etc...
Tools Used
foundry
Recommendations
some form of encryption. user decrypts stored password with their private key for example.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.