No access control for setPassword
Summary
The method setPassword can be called by any address instead of only the owner
Vulnerability Details
On line 23-24 of the smart contract, the comments state that only the owner of the contract is allowed to set a new password. However, the setPassword function has no restriction on who is able to call it. Any external address can call the function and change the password freely.
Impact
Contract is not working as intended and ownership is not correctly implemented
Tools Used
Manual Review
Recommendations
Before changing the state of s_password, there should be a check whether msg.sender == s_owner. Only if this is evaluated as true should the function be executed.
Lead Judging Commences
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.