Sensitive Information publicly accessable
Summary
The password is stored on the blockchain in plain text. This means that if the blockchain is somehow compromised, the password would be visible to the attacker.
Vulnerability Details
s_password is publicly accessable by using getStorageAt, consider storing hashes of sensitive info.
Impact
This directly affects the purpose of the contract, since this is a password manager type contract. Therefore, the integrity of the contract is greatly compromised.
Tools Used
Manual review
Recommendations
A more secure method might be to store a hash of the password instead of plain text, although this would only allow verification rather than password recovery.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.