First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of sanity checks password input

aballok

Summary

Setter functions does not sanity check its values

Vulnerability Details

It is possible to submit an empty password via submitting an empty string. Imagine a UI that may send in default value by error and default value of string is "" implying empty password is set

Impact

User may save empty password by error and discard the password e.g on paper or elsewhere false believing they saved the password successfully using the contract only to retrieve empty password later when they need it. Input values for functions need to always be sanity checked

Tools Used

Manual Analysis

Recommendations

Check that password input newPassword is not empty string

function setPassword(string memory newPassword) external {
bytes memory bytesString = bytes(newPassword);
require(bytesString.length != 0, "empty password not allowed");
s_password = newPassword;
emit SetNetPassword();
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Invalidated
Reason: Admin Input/call validation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.