Submission Details
Severity:
Lack of access control when setting new password
Summary
Password can be changed by anyone because of missing access control.
Vulnerability Details
The setPassword function must be callable by the owner only. However, it lacks access control, therefore it can be called by anyone.
Impact
The actual password can be lost and overwritten by a new one.
Tools Used
Manual Review
Recommendations
Add a form of access control:
function setPassword(string memory newPassword) external {
+ require(msg.sender == s_owner)
s_password = newPassword;
emit SetNetPassword();
}
Updates
Lead Judging Commences
inallhonesty
about 2 years ago
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.