First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can set a new password

ilovemiagoth

Summary

Anyone can set a new password by calling setPassword().

Vulnerability Details

Despite the comment saying only the owner can set a new password, the function setPassword can be called by anyone. That means anyone can overwrite whatever password the owner had set.

Impact

High.

Tools Used

n/a.

Recommendations

Make the PasswordStore inherit from Ownable.sol from OpenZeppelin so you can add the onlyOwner modifier to setPassword.

Another option would be to skip inheritance and just declare your modifier with:

modifier onlyOwner(){
if(msg.sender != s_owner){
revert PasswordStore__NotOwner();
}
_;
}

and proceed to add the modifier wherever needed.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.