First Flight #1: PasswordStore

Summary

The setPassword method is not protected and every account/contract can call it to change the password.

Vulnerability Details

On line 26 of the PasswordStore.sol, we have a method, setPassword, that is not very well protected. Any contract/account can call it to change the password.

Impact

This can lead to all sorts of problems, from the transfer of ownership to the theft of tokens/balances.

Tools Used

Recommendations

• Add a modifier function onlyOwner, which makes sure that the caller (msg.sender) is the owner of the contract, to the setPassword method.

• Remove the from line 36-39 of the getPassword method and add the same onlyOwner modifier to it.