First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`setPassword()` missing owner check - Unauthorized users can change password

0xloscar01

Summary

The function PasswordStore.sol::setPassword() is vulnerable as it can be called by any user, not just the owner, allowing unauthorized changes to the password.

Vulnerability Details

In PasswordStore.sol#L26-29, the function setPassword()` is expected to allow only the owner to set a new password.
However, any user or contract can invoke this function.

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Exploit scenario:

Initial state:

  • The PasswordStore contract has been deployed by a legitimate owner.

  • The owner has set a private password using the setPassword() function.

Step 1: an attacker calls the PasswordStore contract function setPassword(), changing the password without the owner's permission.

Outcome: due to a lack of ownership check in the setPassword() function, the password within the PasswordStore contract gets overwritten with the attacker's specified password.

Implications: the purpose of the PasswordStore contract is compromised, as any user can change the password without the owner's knowledge or consent.

Impact

Any user can change the password stored in the PasswordStore contract without the owner's knowledge.

Tools Used

Manual review.

Recommendations

Ensure that the setPassword() function checks if msg.sender is the contract owner:

function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.