First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect access control: Anyone can change the password

0xbigwing

Summary

The contract lacks proper access control, making it susceptible to unauthorized changes to the password by anyone.

Vulnerability Details

The function SetPasswoord doesn't validate if the caller is authorized to change the password.

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Impact

The impact of this vulnerability is severe. The lack of access control means that anyone can change the password. This opens the door to unauthorized access, data tampering, or even the potential disruption of the contract's intended operation. Consequently, the security of the contract and its users is at risk.

Tools Used

VScode and REMIX IDE.

Recommendations

Ownable mechanism.

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.