First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Everyone is able to call setPassword function

mld

Summary

There is no restriction about who is able to call setPassword function. Every user and contract is able to call it and change current password.

Vulnerability Details

Missing check for owner will allow all users to change the password. This way, it is possible for anyone to change your password and you will not have access to your old password that you have saved

Impact

By creating Attacker contract the contract is able to call PasswordStore contract and change it's password because there is not modifier to check that only owner of PasswordStore contract can change the password.

contract PasswordStore {
error PasswordStore__NotOwner();
​
address private s_owner;
string private s_password;
​
event SetNetPassword();
​
constructor() {
s_owner = msg.sender;
}
​
​
/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
​
/*
* @notice This allows only the owner to retrieve the password.
* @param newPassword The new password to set.
*/
function getPassword() external view returns (string memory) {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
return s_password;
}
}
​
contract Attacker {
PasswordStore public contractToAttack;
constructor(PasswordStore _contractToAttack) {
contractToAttack = _contractToAttack;
}
​
function setNewPassword() public {
// Change password in PasswordStore contract
contractToAttack.setPassword("HACKED!");
}
}

Tools Used

Manual Review

Remix Ide

Recommendations

Create onlyOwner modifier to check that only the owner of contract is able to execute function and attach the modifier to setPassword function

modifier onlyOwner {
require(msg.sender == s_owner, "Not owner");
_;
}
function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.