The password can be changed anytime aby anyone
Summary
The external setPassword function allows any user to set the new password.
Vulnerability Details
The external setPassword function is designed to allows only the owner to set a new password as per the notices (L23).
However, this function does not apply any restriction that will restrict this function to only the owner can call.
Therefore, the setPassword function is now behalf as a external that allows everyone to call and set new password of the contract.
Impact
The password can be changed anytime aby anyone
Tools Used: manual
Recommendations:
Apply the restiction to this function to allow only the owner of the contract to call.
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.