Summary

Lack of access control in PasswordStore.setPassword() let non-owner user to set a new password

Vulnerability Details

Based on the context, PasswordStore.setPassword() should be onlyOwner as it should only be allowed to be called by the owner.

However, PasswordStore.setPassword() lack access control in the current implementation.

Impact

An non-owner users can call setPassword() to set another new password, when the owner tries to get the previously set password, he gets an incorrect password.

Tools Used

Manual Review

Recommendations

PasswordStore.setPassword() should be onlyOwner or check if msg.sender is the owner.