TL;DR the password was visible on the blockchain using the `getStorageAt` method. You could then change the owner and set the seed at your leisure.The exploit from level 2 also worked.
[Read More](https://github.com/pietroferretti/ctf/tree/master/secconquals2018/gacha)