First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can calls setPassword() provocating the password to be lost.

ivanfitro

Summary

Anyone can call the setPassword(), potentially causing the loss of the stored password owned by the contract, thereby compromising the core functionality of the smart contract designed to securely store passwords.

Vulnerability Details

setPassword() is external and lacks proper control accesses. An attacker can call the function and set a random password, causing the legitimate owner to lose their password. This completely breaks the intended functionality of the smart contract.

Impact

Owner losses their password.

Tools Used

Manual review

Recommendations

Add a acces control like getPassword():

function setPassword(string memory newPassword) external {
+if (msg.sender != s_owner) {
+revert PasswordStore__NotOwner();
+}
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!