Non owner can read the password
Summary
Contrary to the intent of the contract, anyone could read the contents of s_password, using eth_getStorageAt.
Vulnerability Details
Even though there is a test for preventing access to s_password through getPassword, and there is an owner check in getPassword, this does not prevent someone from reading what is stored onchain. You can use an web3 client to call eth_getStorageAt to read the state variable.
Impact
Contract doesn't live up to its intent, the password is not protected at all.
Tools Used
Anvil
Recommendations
Could consider dropping this contract idea. Could also use encryption to mitigate the issue. If the owner used a key for example and encrypted the value using symmetric encryption, it could be usable, but I'd question the point.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.