Anyone can access stored password
Summary
Anyone can access stored passowrd in s_password variable.
Vulnerability Details
Private variables in solidity are not "private". Anyone can see their value inspecting contract storage. For example in this case with web3.js we can spot the password using web3.eth.getStorageAt(<contract_address>, 1).
Impact
Contract core functionality is broken. Anyone can see owner password.
Tools Used
Manual review
Recommendations
Contracts can't store plain text password on-chain because anyone can read contract storage. If you want to store something like a password for authorization purpose use the hashed value of that password using keccak256 algorithm. Then hash it off-chain and send the hashed value to the contract to check if they are equal.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.