First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

In the `setPassword` function, there is `no check for owner`, it allows anyone to `change the password` by calling the setPassword function.

naman1729

Summary

  • In the setPassword function, Anyone can change the password by calling the setPassword function because there is no check for owner. So, Check for owner should be added in the setPassword function to prevent from the change of password by other address (except owner).

Vulnerability Details

/**
@> * @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
​
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

  • Here, In the documentation, it is mentioned that only the owner can set a new password. But, there is no check for owner in the setPassword function. So, anyone can change the password by calling the setPassword function.

  • So, Check for owner should be added in the setPassword function to prevent from the change of password by other address (except owner).

Impact

  • password can manupilated by anyone.

// Here non-owner is able to set password. This can create a manipulation in password.
function test_non_owner_can_set_password() public {
vm.startPrank(address(2));
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
vm.stopPrank();
​
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
vm.stopPrank();
assertEq(actualPassword, expectedPassword);
}

Tools Used

  • Manual review

  • Remix

  • foundry

Recommendations

/**
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
​
function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
​

  • Check for owner should be added in the setPassword function to prevent from the change of password by other address (except owner).

  • if caller is not owner then revert PasswordStore__NotOwner().

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.