First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

setPassword()function does not verify if sender is owner of contract

yeahchibyke

Summary:

setPassword() function does not check if the sender is the owner of the contract

Vulnerability Details:

The setPassword() function does not check if the sender is the owner of the contract.

Impact:

This vulnerability allows anyone to change the password, which is not the intended behavior.

Tools Used:

Replit IDE, Foundry, Remix, PhindAI

Recommendations:

function setPassword(string memory newPassword) external {
require(msg.sender == s_owner, "This function can only be called by the owner");
s_password = newPassword;
}

The setPassword() function now checks if the sender is the owner of the contract before changing the password. This is done using the require function, which throws an error if the condition is not met.

Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.