First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

a not-owner user can change the password

rapstyle

Summary

A not-owner user can change the password. The PasswordStore::setPassword function should only be usable by the owner of the smart contract.

Vulnerability Details

The PasswordStore::setPassword function does not check whether the user who is calling the function is the owner of the contract or not. This means that any user who calls the function can change the password.

function setPassword(string memory newPassword) external {
@> s_password = newPassword;
emit SetNetPassword();
}

Through this test you can verify that a not-owner user is able to change the password.

function test_not_owner_can_set_password() public {
// User not owner can change the password
vm.startPrank(address(1));
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
​
// Check if password is changed
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

Impact

The impact is high because the function was designed to be used only by the owner, therefore this vulnerability causes a high damage to the smart contract because the operation is not as desired.

Tools Used

  • manual review

  • foundry

Recommendations

To avoid this vulnerability you need to create a modifier that is called on the function PasswordStore::setPassword. This modifier verifies that the user who is calling the function, via the value of msg.sender, is equal to the value saved inside s_owner.

+ modifier isOwner() {
+ _checkOwner();
+ _;
+ }
​
+ function _checkOwner() internal view {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
+ }
​
- function setPassword(string memory newPassword) external {
+ function setPassword(string memory newPassword) external isOwner {
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!