First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of access control in `setPassword` function

jnrlouis

Summary

Lack of access control in setPassword function

Vulnerability Details

Lack of access control in setPassword function allows anyone to change the password, and not necessarily the owner can change password as it was intended.
https://github.com/Cyfrin/2023-10-PasswordStore/blob/856ed94bfcf1031bf9d13514cb21b591d88ed323/src/PasswordStore.sol#L26

Impact

The password is for the streets. If anyone can change your password, is it really YOUR password?

Tools Used

Manual Review

Recommendations

Add an onlyOwner modifier to the setPassword function, OR simply add a check that allows only the owner to be able to change the password.

function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) { // <--- Check here
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.