First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Password overwrite due to Lack of Access Control

aballok

Summary

Critical function to set password lacks access control so anyone can call function

Vulnerability Details

setPassword(string memory newPassword) external { ... is an external function that can be called by anyone. This implies that anyone can change your password resulting in your real old password being lost to you. This ability to overwrite password safely defeats the purpose of the contract to act as a safe store of password that you can retrieve when you need

Impact

Your password can be overwritten by anyone at any time leading to you losing your desired password

Tools Used

Manual Analysis

Recommendations

Ensure function has access control e.g so only called by contract owner

function setPassword(string memory newPassword) external {
require(msg.sender == s_owner, "not owner");
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.