Submission Details
Severity:
Function `setPassword` does not have proper access control
Summary
There is no access control to ensure only the s_owner can set the password.
Vulnerability Details
The comments for setPassword function specify that the function should be only called by the owner, but there isn't any access control to ensure that.
/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
Impact
Anyone can change the password.
Tools Used
Manual Review
Recommendations
Add a check to ensure that msg.sender == s_owner
Updates
Lead Judging Commences
inallhonesty
about 2 years ago
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.