First Flight #1: PasswordStore

Summary

Method setPassword can be used by anyone, and not only the owner as the NatSpec indicates.

Vulnerability Details

The method setPassword lacks of access control code. Because it never asks for the sender to be equal to the owner (as the "getPassword" method does), anyone can update the password arbitrarily.

Impact

This could bring down the whole purpose of the smart contract. The contract owner will never be sure of the stored password due to its lack of protection against arbitrary updates.

Tools Used

Manual

Recommendations

Anytime you want a variable to be updated only by the owner, use a modifier like "onlyOwner" from Ownable OpenZeppelin contracts or just check if the msg.sender is the one you want.