First Flight #1: PasswordStore

Summary

There are 2 problems in the code.

1.The setPassword function does not detect the owner. Anyone can change the owner's password.
2.Although s_owner and s_password are private, because these data are on the chain, anyone can see the contents of s_owner and s_password through some tools, such as foundry's cast.

Vulnerability Details

1. function setPassword(string memory newPassword) external {
   s_password = newPassword;
   emit SetNetPassword();
   }

setPassword has no check on owner.

2. address private s_owner;
   string private s_password;

s_owner and s_password use private visibility.
Everything that is inside a contract is visible to all observers external to the blockchain. Making something private only prevents other contracts from reading or modifying the information, but it will still be visible to the whole world outside of the blockchain.

Impact

High Risk

Recommendations