First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can set new password

caxva

Summary

The function setPassword can be accessed by ANYONE!
In the following function we see that there is no if condition is given, like the one which is given for the getPassword function, making it not an onlyOwner function.

Vulnerability Details

High Risk

Impact

Here, if anyone can set a new password then there will be no sense of the protocol boldly mentions: "Never worry about forgetting your password again!" In this case, a malicious user can easily change the password and hence I am giving it a high risk remark since this would signify the protocol don't exist.

Tools Used

Manual Scanning

Recommendations

include a if condition inside the function setPassword which can be something like this:

function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.