First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No owner checks when setting password

trauki

Summary

The setPassword() function is supposed to be only callable by the owner of the contract, however, there are no checks in place to confirm the owner is calling the function, meaning anyone can set the password.

Vulnerability Details

The setPassword() function takes in a single string as input, then the first thing it does is set the s_password variable to whatever the input is. The second, and final, thing the function does is emit the SetNetPassword() event. Here you can see the function, and the developer's comment claiming the function "allows only the owner to set a new password".

/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

To prove that anyone can set the password, here is a test I've added to the PasswordStore test file that allows a random address to set the password.

function test_non_owner_can_set_password() public {
vm.prank(address(1337));
string memory expectedPassword = "Froggy";
passwordStore.setPassword(expectedPassword);
vm.prank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

In this test you can see that address(1337) set the password to Froggy and we saved it in a variable called expectedPassword. After saving the variable we call the getPassword() function and store its current value to the actualPassword variable. Finally, we use assertEq() to ensure that the two variables are indeed the same.

Impact

Anyone is allowed to set the password, essentially destroying the developer's intentions.

Tools Used

Manual review.

Recommendations

To fix this I recommend you include the exact same if statement that was used inside the getPassword() function like so.

/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}

To prove that only the owner can now call the function I've modified the test I added.

function test_non_owner_setting_password_reverts() public {
vm.startPrank(address(1));
​
vm.expectRevert(PasswordStore.PasswordStore__NotOwner.selector);
passwordStore.getPassword();
}

As you can see, trying to call the setPassword() function from an address that isn't the owner will now revert with the PasswordStore__NotOwner() custom error.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.