Submission Details
Severity:
Setter functions not checking if old value differs new value
Summary
Setter functions does not sanity check its values if old value is the same as new value
Vulnerability Details
It is possible to submit new password that is same as old password by mistake
Impact
User may sae old password by error and discard the new password e.g on paper or elsewhere believing they saved the new password successfully using the contract only to retrieve old password later when they need it.Meaning they lose their new password. Input values for functions need to always be sanity checked
Tools Used
Manual Analysis
Recommendations
Check that password input newPassword is not empty string
function setPassword(string memory newPassword) external {
bytes memory bytesString = bytes(newPassword);
require(keccak256(abi.encodePacked(oldPassword)) != keccak256(abi.encodePacked(newPassword)));
s_password = newPassword;
emit SetNetPassword();
}
Updates
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.