First Flight #1: PasswordStore

Summary

The SetNetPassword event in the PasswordStore contract lacks detailed information, making auditing and tracking of password changes challenging.

Vulnerability Details

The event is emitted whenever the password is changed, but does not provide the address that initiated the change or the timestamp. This lack of information makes it difficult to understand what the purpose of this event is. Additionally, the event name "SetNewPassword" is misleading.

Impact

The absence of detailed event data compromises the contract's transparency and auditability, making it difficult to track changes on indexing protocols.

Tools Used

Manual analysis.

Recommendations

Update the SetNetPassword event to include parameters like the caller’s address and timestamp to facilitate better indexing. Additionally, consider renaming the name to something more indicative, such as PasswordUpdated or even PasswordSet.