First Flight #1: PasswordStore

Summary & Vulnerability Details

The NatSpec in the setPassword function tells that the function is controlled by the owner, but there is no owner access check done in that function.

Impact

Because this function can be invoked by anyone, it can lead to other users overstepping their authority to set passwords.

Tools Used

Manual Review

Recommendations

1. prefix the s_password = newPassword; code with the following conditional judgment: if (msg.sender ! = s_owner) { revert PasswordStore__NotOwner(); }

2. You can control the invocation of this function by setting the modifier.