First Flight #1: PasswordStore

Summary

Any EOA can update owner's password

Vulnerability Details

• Access modifier setPassword is external, but it does not implement any authentication mechanism, like onlyOwner.

• This allows any EOA to update the state variable called s_password freely.

Impact

• Very high.

Tools Used

• Manual inspection

Recommendations

• Implement OpenZeppelin's Ownable contract for authenticating the owner of the PasswordStore.

• Then, add onlyOwner modifier to the setPassword function to allow only the owner to set the password.