First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The `PasswordStore::setPassword` function can be executed by any non-owner to change the password stored on the protocol.

bhvrvt

Summary

The PasswordStore::setPassword function is intended to be executed by only the owner of the protocol, but there are no checks implemented in place in the function's code to ensure this requirement.

Vulnerability Details

Following is the vulnerable piece of code in the PasswordStore::setPassword function :

/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Even though the comments in the code specify that This function allows only the owner to set a new password, there are no checks in place to check whether the user executing this function is actually the owner.

Hence a non-owner attacker can just simply execute this function to change the s_password value stored on the protocol.

Proof of Concept

Actors:

  • Attacker: Any non-owner malicious actor on the network.

  • Victim: Owner of the PasswordStore protocol.

  • Protocol: PasswordStore is meant to allow only the owner to store and retrieve their password securely.

Working Test Case:

Write and run the following test case in the PasswordStore.t.sol test file.

function test_any_non_owner_can_set_password() public {
address attacker = makeAddr("attacker"); // Defines Attacker's address
string memory ownerPassword = "ownerPassword"; // Defines Victim's (Owner's) password
string memory attackerPassword = "attackerPassword"; // Defines Attacker's password
​
​
vm.startPrank(owner); // Simulates Victim's address for the next call
passwordStore.setPassword(ownerPassword); // Victim sets their password (as per intended functionality)
​
​
vm.startPrank(attacker); // Simulates Attacker's address for the next call
passwordStore.setPassword(attackerPassword); // Attacker uses the vulnerable `setPassword` function to change Victim's password to their own
​
vm.startPrank(owner); // Simulates Victim's address for the next call
string memory actualPassword = passwordStore.getPassword(); // Victim fetches the current password stored on the protocol
​
assertEq(actualPassword, attackerPassword); // Returns true, proving Attacker overwrote Victim's password stored on the protocol
}

Impact

This vulnerability grants unauthorized access to any malicious actor on the network to change the Owner's password stored on the PasswordStore protocol. This compromises the integrity of data stored on the protocol.

Tools Used

Foundry

Recommendations

Implement an if condition to check whether msg.sender is the owner of the protocol :

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!