First Flight #1: PasswordStore

Summary

Anyone can call getPassword

Vulnerability Details

getPassword function returns the value of the variable s_password which is meant to be secret. Even though s_password can be read using web3 libraries. The if statement check for the msg.sender being equal to s_owner is not useful because the msg.sender can be set to anything by a malicious in case of call type transaction.

Impact

Anyone can read s_password using the getPassword function.

Tools Used

Manual

Recommendations

There is no gating msg.sender in case of view function and anyways that data can be read using web3 libraries, either store the data in a hashed form so people can read it but cannot make sense out of it or don't store password on-chain.