First Flight #1: PasswordStore

Summary

Users should be strongly advised to never set unencrypted passwords via the setPassword() function.
Only ever store encrypted passwords onchain, if you really want/have to.

Vulnerability Details

n/a

Impact

HIGH?

Tools Used

VSC.

Recommendations

Advise users of this contract/function to never set unencrypted passwords via the setPassword() function because it would be visible/accessible to anyone on the public blockchain.

newPassword should be already encrypted on the user's side before passing it to this function.

Ideally it would be good to implement the password encryption/decryption functionality onchain via the smart contract, so that the user only needs to add their password to the function, which then encrypts it, returns the encrypted copy to the user as well as the decryption key, and then stores the encrypted password onchain for the user.