First Flight #1: PasswordStore

Summary

The main purpose of this smart contract is crippled by a critical vulnerability in the main function of this smart contract.
Anyone can set the password inside of the 'setPassword' function.

Vulnerability Details

Inside of the 'setPassword' function there is no check to verify if the msg.sender is the actual owner of the smart contract.
Anyone is able to set a new password inside the smart contract.
This should not be the case as it renders the smart contract useless.

Impact

This is a high severity issue due to the nature of the bug.
It's fundamental to the functionality of the smart contract

Tools Used

Vs Code
Foundry

Recommendations

Implement a 'onlyOwner' modifier in the contract.
This is also a better way for the 'getPassword' function to validate that the msg.sender is the actual owner.