First Flight #1: PasswordStore

Summary

The setPassword(string memory newPassword) function is external, which means everyone can call this function.

Vulnerability Details

There is no protection to allow only the owner to update the password.

Impact

So, someone could create a smart contract that will call this function and update the password to an arbitrary value.

the owner could loose his password

Tools Used

Recommendations

Use OpenZeppelin's Ownable contract, or add require(msg.sender != s_owner) to the code:

solidity
Copy code
function setPassword(string memory newPassword) external {
require(msg.sender != s_owner);
s_password = newPassword;
emit SetNetPassword();
}