First Flight #1: PasswordStore

Summary

The PasswordStore contract allows any address to set a new password, even if they are not the owner of the contract

Vulnerability Details

The setPassword function in the PasswordStore contract does not have a restriction that checks if the caller is the owner of the contract. As a result, any Ethereum address that interacts with the contract can call this function and overwrite the stored password. Without an ownership check in place, the function does not provide the security it intends to.

Impact

Any malicious actor can overwrite the password stored in the contract without the knowledge or permission of the original owner. This undermines the primary function of the contract, making the stored password insecure.

Tools Used

Manual code review

Recommendations

Implement an ownership check at the beginning of the setPassword function similar to getPassword function