Non-owner can change the password at any moment.
Summary
Any user will be able to change the password of the password store.
Vulnerability Details
The 'setPassword' function does not have any check for users who are able to execute the function. This gives an attacker the ability to change the password at any moment. The owner should be the only user that's able to change the password in the password store contract.
Impact
Any user which executes the 'setPassword' function will be able to change the password in the password store.
Tools Used
Manual Review
Recommendations
Set a only owner modifier or check to ensure that only the owner may change the password.
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.