First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of onlyOwner access control for the setPassword function creates a potential security risk

Osora9

Summary

The setPassword function in the PasswordStore contract lacks an onlyOwner access control mechanism. This absence means any address can call this function and change the password, posing a security risk.

Vulnerability Details

contract PasswordStore {
// ...
​
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNewPassword();
}
// ...
}

In the current implementation of the setPassword function, there is no check to ensure that the caller is the owner (stored in the s_owner variable) of the contract. Without this check, any user can call this function and potentially alter the state of a critical variable in the contract, which is the s_password.

Impact

If malicious actors identify this vulnerability, they could continuously change the password, making the original intent of the contract (a secure place for the owner's password) useless and potentially disrupting the contract's normal operation.

An unauthorized address could interact with the contract as follows:

PasswordStore passwordStore = PasswordStore(<contract_address>);
passwordStore.setPassword("unauthorizedPasswordChange");

Tools Used

・foundry

Recommendations

Implement an onlyOwner access control check in the setPassword function. This check ensures that only the owner can update the password stored in the contract.

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNewPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.