First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can change the password via "setPassword" method.

836541

Summary

The contract has the method "setPassword" to change the stored secret password. However, it doesn't have any access control, so any user can change the password.

Vulnerability Details

This is the method "setPassword":

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

As you can see, it's a external function (anyone can call) that doesn't verify who is the msg.sender. So, any user can change the "s_password" variable.

Impact

As anyone can change the password, the contract isn't reliable to keep any data since anyone can change it maliciously to a different password.

Tools Used

Manual Review

Recommendations

A mapping that maps a msg.sender to a password is useful, but a check if the msg.sender is the owner if even better:

if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.