First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Public access to admin function

alsirang

Summary

The setPassword function can be called by anyone.

Vulnerability Details

The setPassword function is not restricted. It is intended to be an admin function, as mentioned in the comment, but currently, anyone can set a new password.

/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
​

Impact

The setPassword function is intended to be an admin-only function, but there is no access restriction implemented. As a result, anyone, not just the owner or admin, can call this function and set a new password. This could lead to unauthorized access, misuse, or manipulation of the contract.

Tools Used

Manually and VS Code as tool have been used.

Recommendations

To mitigate this issue, access control mechanisms need to be implemented.By implementing proper access control, the contract can enforce the intended restrictions and prevent unauthorized users from modifying data or performing operations.

modifier onlyOwner() {
if (msg.sender != s_owner) revert PasswordStore__NotOwner();
​
_;
}
​
/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

alsirang Submitter
over 1 year ago
inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.