Anyone can see the original password in setPassword function calls
Summary
Because we are calling setPassword providing directly the string that would be the new password, anyone can trivially see it analyzing the transaction in any block explorer
Vulnerability Details
The value passed as a plain string into setPassword is not hidden on the transaction details. Given that this wont be a contract with a lot of transactions, it is trivial to find the latest call to setPassword and extract the string from there.
Impact
This breaks the protocol, as it is supposed to ensure that only the owner can know the password
Tools Used
Etherscan
Recommendations
Don't use a plain string for the password. Sign an arbitrary message with the owner's wallet and then use OZ's cryptography library to recover the signing address within the password contract.
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.