Submission Details
Severity:
Anyone can change password
Summary
Anyone can set a new password.
Vulnerability Details
setPassword function allows anyone to set a password.
Impact
Anyone can change the password, so there is no point of having an owner for the contract. Owner does not have control over the password.
Tools Used
Manual
Recommendations
Add a modifier onlyOwner that checks if the msg.sender is equal to s_owner. An alternative solution would be having an if statement that checks if the msg.sender is equal to s_owner in the setPassword function, if not revert with error PasswordStore__NotOwner.
Updates
Lead Judging Commences
inallhonesty
about 2 years ago
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.