Submission Details
Severity:
Access control issue on setPassword() - anybody can call
Summary
There are no access controls on setPassword().
Vulnerability Details
Anybody can call this function and overwrite what the owner already set.
Impact
High. This defeats the purpose of the contract.
Tools Used
Manual Inspection
Recommendations
Use a modifier like OZ's OnlyOwner or some other way of reverting if the caller is not the contract owner.
Updates
Lead Judging Commences
inallhonesty
about 2 years ago
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.