Function is not restricted to owner
Summary
An important function is callable by anyone.
Vulnerability Details
The function setPassword() (line 26) can be called by anyone, allowing users to change the owner's stored password.
Impact
It disrupts the protocol functionality. The main use case for this contract, saving owner's private password, is no longer viable since everyone can change it.
Tools Used
No Tools.
Recommendations
Add logic to the function so that only the owner can call it, just like in the function getPassword() below.
Adding a modifier with this logic is a must, leaving the code more readable and avoiding repeating the same logic over and over again.
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.