First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The setPassword function lacks owner-specific access control, resulting in the potential for unauthorized individuals to set a new password.

pratred

Summary

Absence of access control checks to validate whether the caller of setPassword function possesses the appropriate ownership credentials.
The setPassword function in the PasswordStore.sol file does not have any checks to determine whether the user calling this function is owner or not.

Vulnerability Details

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

The setPassword function, as currently implemented, lacks the necessary safeguards to ascertain whether the caller is authorized as the owner or not.

Impact

An access control deficiency is observed, permitting the function's invocation by any user to call the setPassword function and set a new password, a deviation from the desired behavior of restricting access solely to the owner.

POC

The setPassword function doesn't check if the user calling it is the rightful owner. This caused a test case to pass even when a user who wasn't an owner was calling it.

function testAnyoneCanSetThePassword() public {
address USER = makeAddr("user");
vm.prank(USER);
string memory expectedPassword = "myNewPassword2";// Set a new password using another address.
passwordStore.setPassword(expectedPassword);
​
vm.prank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

Tools Used

VS Code

Recommendations

Create a modifier or add checks to the setPassword function such that only owner can access this function.

Instead of using this function

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
​

use this

function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.