First Flight #1: PasswordStore

Summary

The setPassword function lets anyone set the password. This could lead to a loss of funds for the owner. It is a high-severity bug.

Vulnerability Details

->The setPassword function does not have any access modifier implemented nor a check within the function whether the EOA or the contract that is calling this function is the owner.

Impact

This is a Password storage contract so if a malicious user changes the password then he/she can get access to all the privileges and control that the owner has which can lead to loss of funds, Denial of Service(DoS), etc.

Tools Used

VS code, Remix

Recommendations

It is recommended to add a required statement before making any state changes in the function that checks whether the caller is the owner or not.
-->
require(msg.sender==s_owner);

->An Access modifier can also be used.