First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access control in `setPassword`

merklebonsai

Summary

setPassword function is missing the ownership check, allowing anyone to modify stored password

Vulnerability Details

setPassword is expected to be readable only by owner, according to @notice This function allows only the owner to set a new password. However, due to missing check (like in getPassword) it is publicly available, allowing anyone to mess up with the stored password.

Impact

High, Improper access control.
Real future impact depends on actual application of contract

Tools Used

Brains, mostly. Also, foundry.

Recommendations

  1. Use same check as in getPassword in setPassword function:

if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}

Also, test case for this scenario:

function test_non_owner_writing_password_reverts() public {
vm.startPrank(owner);
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
​
vm.stopPrank();
vm.startPrank(address(1));
​
vm.expectRevert(PasswordStore.PasswordStore__NotOwner.selector);
passwordStore.setPassword(expectedPassword);
}

  1. move the check to modifier or internal function to avoid code duplication; otherwise developers may accidentally modify only part of checks in a future (e.g. when adding support of ERC2771 transactions)

  2. Adopt some QA framework that is consistently pessimistic; currently, based on naming convention, looks like the tests are not aiming to support all cases of matrix scenario (owner/non-owner can read/write)

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.