First Flight #1: PasswordStore

Summary

In PasswordStore.sol - function setPassword() - only the owner should be allowed to set the password.
A check is missing if the function is called by the owner.

Vulnerability Details

File: PasswordStore.sol
Function: setPassword()
Code Line: 26-29

Missing check to validate if the password is set by the owner in the setPassword() function.

Impact

Anyone user other than the user can set the password. Only the owner should be allowed to set the password

Tools Used

Foundry, Remix

Recommendations

Introduce a check in setPassword() function as shown below:

@@ -24,6 +24,9 @@ contract PasswordStore {
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {

•    if (msg.sender != s_owner) {
  

•        revert PasswordStore__NotOwner();
  

•    }
     s_password = newPassword;
     emit SetNetPassword();
  

  }