First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing owner check allows non-owner to set password

MikeDougherty

Summary

The PasswordStore.sol allows only the owner to read the password while anyone can write the password.

Vulnerability Details

The setPassword() does not verify that the msg.sender is the s_owner. This allows anyone to update the s_password to any value.

function setPassword(string memory newPassword) external {
// NOTE: missing check that msg.sender is s_owner
s_password = newPassword;
emit SetNetPassword();
}

This can be proven by adding a test case in PasswordStore.t.sol that looks like this:

function test_non_owner_set_password_reverts() public {
vm.startPrank(address(1));
passwordStore.setPassword("YouAreLockedOut");
​
vm.startPrank(owner);
string memory currentPassword = passwordStore.getPassword();
assertNotEq(currentPassword, "myPassword");
assertEq(currentPassword, "YouAreLockedOut");
}

Then run make test and observe that the tests pass, which indicates that the password was indeed changed by someone other than the owner.

Impact

This would prevent the owner from being able to use the password as intended. The owner could always change the password to another value to continue using services that relied on this store. But it would leave any service and data relying on this store exposed.

Tools Used

Manual Review and Foundry

Recommendations

Add check in the setPassword() function that is similar to the one in the getPassword().

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}

Alternatively, create a modifier that can be used for both functions:

+ modifier onlyOwner() {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
+ _;
+ }

Then, both functions could be simplified as:

- function setPassword(string memory newPassword) external {
+ function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
​
+ function getPassword() external view onlyOwner returns (string memory) {
- function getPassword() external view returns (string memory) {
- if (msg.sender != s_owner) {
- revert PasswordStore__NotOwner();
- }
return s_password;
}

Or, another alternative could be to inherit from OpenZeppelin's Ownable contract. This would remove the need for creating the modifier while allowing the function to remain simple.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.