Submission Details
Severity:
owner should not be allowed to set empty string as password
Title
empty string should not be accepted as password
Bug
an empty string is the most vulnerable, unsafe and worst password someone could choose, the setPassword function doesn't have any checks to ensure newPassword entered by owner is not an empty string
POC
owner here is trying to set empty string as password and it successfully gets updated
function test_empty_string_gets_accepted_as_password() public {
vm.startPrank(owner);
string memory newPassword = "";
passwordStore.setPassword(newPassword);
}
Fix / Suggestions
there should be checks applied on the password, for ex: s_password.length>0 or if the password contains mix of characters and numbers to ensure it's safe
Updates
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.