Anyone can retrieve the password
Summary
The s_password could be retrieved by either analyzing the smart contract storage layout or the setPassword() transaction data.
Vulnerability Details
Storing plaintext password in a smart contract is not a good idea. The storage of a smart contract is public to anyone having access to a blockchain node. Specifically, by using the getStorageAt() RPC, all storage slots of a smart contract could be retrieved. An even easier way is using the "evm.storage" tool.
Impact
Anyone can retrieve the password.
Tools Used
Manual review
Recommendations
Don't use public chain to store password.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.