Anyone can set the Password
Summary
The PasswordStore smart contract allows anyone to set the password, which contradicts its intended functionality of storing a private password, as according to the Natspec only the owner should be able to store the password
Vulnerability Details
The setPassword function lacks access control, allowing any address to update the stored password. This is a severe security flaw as it should only be accessible by the contract owner.
Impact
This vulnerability compromises the integrity and security of the password storage system. It means that unauthorized parties can alter the stored password, potentially leading to unauthorized access.
Tools Used
Manual Review
Recommendations
Implement an access control mechanism, such as a modifier or function modifier, to ensure that only the owner of the contract can set the password.
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.