First Flight #1: PasswordStore

Summary

setPassword() is problematic function

Vulnerability Details

setPassword() could be executed from entity different than the owner.

Impact

The password can be changed by address different than the owner.

Tools Used

manual testing

Recommendations

add modifier to check for owner

modifer owner() {
require(owner == msg.sender);
_;
}

and add it to setPassword() function like this:
function setPassword(string memory newPassword) external owner {
}