[H-02]: It is risky to store any form of password on the blockchain, even when it could be encoded
Impact
The password represented by the private variable s_password is not actually private, as anyone can easily use a block explorer or similar tool to retrieve the password of the owner and potentially access the owners controls/accounts that rely on this password, which may or may not involve sensitive information or even large amounts of funds.
Tools Used
Manual Analysis
Recommendations
Even if some mechanism is used to encode the password, as long as there is a variable/function present to retrieve the password, any user could eventually retrieve the password. As such, password storage should be kept off-chain for now to prevent any risk of password access.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.