Anyone can change the owner's password.
Summary
Anyone can call the method setPassword and change the owner's password
Vulnerability details
The setPassword method does not have any access control modifier. For this reason anyone can call this method and change the owner password.
Impact
This will certainly result in changing the owner's password by anyone.
Tool Used
I used foundry to test the setPassword making the transaction with an address different than the owner address.
Recommendations
Inherit OpenZeppelin Ownable contract to use the onlyOwner modifier on the setPassword method to prevent other users from changing the owner's password.
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.