First Flight #1: PasswordStore

Summary

The problem with the code is that it does not adequately protect the stored password, and it relies solely on the msg.sender to check the owner's identity.

Vulnerability Details

function setPassword() don't check that the caller is owner or not

Impact

problem is that anyone who has the contract's address can become the owner and set or retrieve the password.

Tools Used

VScode

Recommendations

Use modifier to check that caller is owner

• modifier onlyOwner() {
  require(msg.sender == s_owner, "Only the owner can call");
  _;
  }

• function setPassword(string memory newPassword) external;

• function setPassword(string memory newPassword) external onlyOwner;