First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Attacker can change owner's password

denzi

Summary

An attacker can exploit the protocol and change owner's password directly by calling the setPassword function.

Vulnerability Details

An attacker can call the setPassword function anytime and pass in a string to change the owner's password. This is due to no require or condition present in the setPassword function which should check if the msg.sender is the owner.

Actors:

  • Attacker: Any Address can be the attacker. The attacker will call setPassword function passing in their own desired password which will overwrite the owner's current password.

  • Victim: The Owner will call getPassword function after the attack is completed. The owner will receive the overwritten/wrong password.

  • Protocol: The protocol provides two functions setPassword and getPassword. In the initial state the owner has set their password to MyPassword but due to a check for owner missing in setPassword, any address can call the function and set Owner's password to a different string.

Working Test Case:

​
// Solidity code or test case demonstrating the vulnerability
// Initial password is set as 'MyPassword' in the deploy script
function test_non_owner_can_change_password() public {
​
vm.startPrank(address(1)); // Attacker starts
string memory changedPassword = "myNewPassword"; // Initializing new string to set as password
passwordStore.setPassword(changedPassword); // Attacker calls setPassword(changedPassword) and changes the password of the owner from 'MyPassword' to 'myNewPassword'
vm.stopPrank(); // Attacker stops
​
vm.startPrank(owner); // Victim Starts
string memory currentPassword = passwordStore.getPassword(); // Victim calls getPassword() to retrieve password
vm.stopPrank(); // Victim Stops
assertEq(currentPassword, changedPassword); // test passes hence currentPassword for owner is set to 'myNewPassword'
}

Impact

There's a severe disruption of protocol functionality since the protocol is supposed to store the password for the owner so they can never forget about their password, attacker can change the password and the owner's password will be overwritten with the new password set by the Attacker.

Tools Used

Manual Review, Forge Unit Test

Recommendations

Owner check used in getPassword function should also be used in setPassword function.
The lines of code will change for setPassword to the following:

function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}

This will ensure that the msg.sender is always the Owner else the function will revert with error PasswordStore__NotOnwer();

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.