First Flight #1: PasswordStore

Summary

Any one can set new password.

Vulnerability Details

setPassword function (code) has no internal checks or modifiers to make sure msg.sender is indeed the owner.

Impact

Actual password that owner set will be rewritten and lost.

Tools Used

None.

Recommendations

Similar to the check in getPassword function (code), add an if block that reverts if msg.sender is not the owner.

Even better, create a new modifier (e.g. onlyOwner) that contains the said if block and add this modifier to both setPassword and getPassword functions to make sure no one other than the owner can call these functions to modify the password / see the password.