Submission Details
Severity:
Same value can be set easily as a new password.
Summary
Same value can be set again in the setPassword(...) that will cause unnecessary gas usage.
Vulnerability Details
Function setPassword(...) does not check if the same value is stored again as a new password. This will cause an unnecessary state update.
Test for PoC
function test_same_password_can_be_set_again() public {
vm.startPrank(owner);
// new Password will be same as old password
string memory newPassword = "myPassword";
passwordStore.setPassword(newPassword);
}
Output:
gitpod /workspace/2023-10-PasswordStore (main) $ forge test --mt test_same_password_can_be_set_again -vvvv
[⠔] Compiling...
[⠘] Compiling 1 files with 0.8.18
[⠃] Solc 0.8.18 finished in 1.14s
Compiler run successful with warnings:
Warning (2018): Function state mutability can be restricted to view
--> test/PasswordStore.t.sol:38:5:
|
38 | function test_anyone_can_read_the_password() public {
| ^ (Relevant source part starts here and spans across multiple lines).
Running 1 test for test/PasswordStore.t.sol:PasswordStoreTest
[PASS] test_same_password_can_be_set_again() (gas: 14464)
Traces:
[14464] PasswordStoreTest::test_same_password_can_be_set_again()
├─ [0] VM::startPrank(DefaultSender: [0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38])
│ └─ ← ()
├─ [3886] PasswordStore::setPassword(myPassword)
│ ├─ emit SetNetPassword()
│ └─ ← ()
└─ ← ()
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 10.31ms
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)
gitpod /workspace/2023-10-PasswordStore (main) $
Impact
Unnecessary gas spent on changing the password to same value.
Tools Used
Manual Review
Recommendations
Only update the state when old password is not equal to new password.
Updates
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.