First Flight #1: PasswordStore

Summary

The contract's "setPassword" function currently permits any user to set the password.

Vulnerability Details

The "setPassword" function lacks proper access control to verify whether the user executing the function is the owner of the contract. As a result, it allows unauthorized individuals to set the password, creating a critical security flaw.

Impact

If anyone can set the password without proper access control, it can lead to a situation where unauthorized changes are made to the stored password. This unauthorized alteration could result in discrepancies between the expected and the actual password, potentially compromising the security and functionality of the contract or any systems relying on the correct password.

Tools Used

Manual

Recommendations

To address the vulnerability in the "setPassword" function, it is strongly advised to introduce an access control modifier that verifies if the user executing the function is the owner. If the sender is not the owner, an error should be triggered, specifically the "NotOwner" error.

Implement the following changes:

By incorporating these modifications, the contract will effectively restrict password setting to the owner, enhancing security and ensuring that unauthorized parties cannot alter the password.