First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted Access to `setPassword` Function

Skalv

Description

The setPassword function allows the contract owner to update the password stored in the contract. However, the function lacks a modifier or a condition to check that the caller (msg.sender) is the contract owner. This omission allows any Ethereum address to call setPassword and change the password, which directly violates the contract's intended access control and functionality.

Code Snippet

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Impact

This issue is categorized as High/Critical severity due to the following impacts:

  • The absence of access control on the setPassword function allows any Ethereum address to change the password.

  • Once an unauthorized address changes the password, the legitimate contract owner loses access to their stored password, which severely violates the contract's core functionality.

  • The contract's main purpose is compromised, and the integrity and security of the stored password are completely undermined.

Tools Used

Recommendations

Implementing an access control check in the setPassword function to ensure that only the contract owner can change the password is crucial. This can be done by adding a modifier or a condition to check that msg.sender equals s_owner. Here's a suggested fix:

function setPassword(string memory newPassword) external {
require(msg.sender == s_owner, "PasswordStore: Not the contract owner");
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.