First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

setPassword not reverting when called by non owner causes password loss

0xads90

Summary

Function PasswordStore::setPassword does not check if the caller is the owner, so that an attacker can overwrite the password causing the loss of the owner's password.

Vulnerability Details

/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

The function above does not check the msg.sender so that everyone can call it. An attacker can therefore overwrite the owner's password. This is not the intended behaviour since in the documentation it's clearly written that ONLY the owner can set a new password.

Impact

The following code, if inserted in PasswordStore.t.sol, proves that an attacker can successfully overwrite the owner's password.

function test_non_owner_can_set_password() public {
// an attacker attempts to set a new password
vm.startPrank(address(1));
string memory maliciousPassword = "maliciousPassword";
passwordStore.setPassword(maliciousPassword);
vm.stopPrank();
// getPassword the returns the malicious password to the owner
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, maliciousPassword);
}

Tools Used

foundry

Recommendations

In function PasswordStore::setPassword revert if msg.sender is not the owner.

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}

Also add the following test to PasswordStore.t.sol

function test_non_owner_setting_password_reverts() public {
vm.startPrank(address(1));
string memory maliciousPassword = "maliciousPassword";
vm.expectRevert(PasswordStore.PasswordStore__NotOwner.selector);
passwordStore.setPassword(maliciousPassword);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.