Password is not secured
Summary
The password was saved as a state variable and making it easy for attacks.
Vulnerability Details
This vulnerability was founed on line 14. the password was stored in the blockchain which therefore makes it public to anyone and can easily be altered by anyone.
Impact
since the contract was written in solidity it is easier using decompiler to view the contract, so the private variables can be viewed too.
Tools Used
Foundry
Recommendations
using cryptographic techniques such as storing the keccak hash of the password and then covert it using abi.encode.
this way it is safely protected.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.