Storage is view-able
Summary
Although the variable is marked private anyone could view it on the chain. On top of that they would also be able to view the TX that submitted it
Vulnerability Details
Anyone can read the storage of this contract using foundry, on top of that they would also see the TX that submitted the string.
Impact
Anyone can access the password.
Tools Used
Manual review
Recommendations
This code is useless as nothing is private on the chain, and nothing should be kept with the assumption that it can be private.
Lead Judging Commences
finding-anyone-can-read-storage
Private functions and state variables are only visible for the contract they are defined in and not in derived contracts. In this case private doesn't mean secret/confidential
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.