Improper Access Control - Anyone can override the Owners password
Summary
The setPassword() method lacks proper access control allowing any account (EOA or Contract Account) to call this function and override the owner's password. This is a very serious issue since it breaks the first Invariant of this Smart contract and therefore a high risk severity.
Vulnerability Details
An attacker or malicious contract / account can freely call the setPassword() function, passing their own newPassword as argument and overidding the password stored by the owner, leading to data corruption.
Impact
High Severity - Loss of data and data corruption
Tools Used
Manual Review, SWC, Foundry Test & Sepolia TestNet.
Recommendations
Create a proper access control check on the setPassword() function
Create an onlyOwner modifier to be used on the setPassword() and getPassword() functions, to avoid code repetition
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.