First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No Access Control on `setPassword` Function

nisedo

Vulnerability Details

The setPassword function allows any address to set a new password. The function does not check if the caller (msg.sender) is the owner of the contract. This means that any user can overwrite the password, potentially locking out the legitimate owner.

Impact

High. Unauthorized users can change the password without the owner's knowledge or consent, leading to potential loss of access for the owner.

Recommendations

Implement access control on the setPassword function to ensure only the owner can modify the password. This can be achieved by adding a check similar to the one in the getPassword function.

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.