First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-0] Missing access control in `PasswordStore::setPassword` allows anyone to set a new password

0xSimeon

Summary

Upon deployment of the contract, there is an assumption that only the owner s_owner can set and retrieve a password. But the missing access control check in: https://github.com/Cyfrin/2023-10-PasswordStore/blob/856ed94bfcf1031bf9d13514cb21b591d88ed323/src/PasswordStore.sol#L26 means anyone can call setPassword and update the password which is not expected by the owner.

Vulnerability Details

In setPassword, there is no check if the caller of the method is actually the owner's address stored in s_owner during deployment. This results in the s_password storage variable being updated by anyone.

Impact

Anyone can update the password at any time. all access pass.

POC

Add test_non_owner_can_update_password() below to passwordStore.t.sol

function test_non_owner_can_update_password() public {
address randomUser = makeAddr("randomUser");
// call setPassword using a random address and update the stored password.
vm.startPrank(randomUser);
passwordStore.setPassword("anyone_can_set_new_password");
vm.stopPrank();
​
// check if password was updated by non-owner.
vm.prank(owner);
assertEq(passwordStore.getPassword(), "anyone_can_set_new_password");
}

Tools Used

Manual review.

Recommendations

Add a check for the caller of the setPassword() function:

+ error PasswordStore__CallerIsNotOwner();
....
......
​
function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__CallerIsNotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.