First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

any sender can change saved password

0xGhali

Summary

by call function setPassword and pass input any password or empty string from non owner, the function will not revert error nor prevent change s_password value

Vulnerability Details

function setPassword should only change password after verifying the msg.sender is the contract owner himself,
as the current implementation is stored password i changed by the input password directly without validation check

Impact

the main propose for contract is to store and retrieve password by owner vulnerable due to it can be change with any msg.sender

Tools Used

No tool used

Recommendations

add require to check the msg.sender is the owner otherwise will revert error before set s_password

function setPassword(string memory newPassword) external {
require(msg.sender == s_owner, "NotOwner"); //<- add require line
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.