First Flight #1: PasswordStore

Summary

It seems likely as documentation does not state; that the deployer who becomes owner of contracts is based off a single account

Vulnerability Details

Single account control over a smart contract results in centralization risks such that if owner loses access to keys, keys are stolen or account or wallet compromised or keys forgotten there is no way to access and control the smart contract anymore or malicious person who now controls the keys can access password

Impact

Password can be accessed, changed by anyone who gets control over the keys. If keys are lost there is no way to set new password etc

Tools Used

Manual Analysis

Recommendations

Recommended the ownership access control for the contract be a MultiSig e.g 2 of 3 such that even if 1 key is lost or compromised the others still can allow access etc