First Flight #1: PasswordStore

Summary

Any wallet can set a new password.

Vulnerability Details

The intention of this contract is to only allow the owner of Password store to be able to set the password. However, as the method setPassword does not require the sender to be the owner, any wallet can set a new password.

Impact

As soon as a malicious actor wants to overwrite passwords they can do it freely, so it makes this app unusable.

Tools Used

Recommendations

Add the same requirement added in the view function :

    if (msg.sender != s_owner) {
        revert PasswordStore__NotOwner();
    }