Submission Details
Severity:
Missing access control on setPassword function
Summary
An important function for setting a password which should only be allowed for the owner is missing access control so anyone can change the password.
Vulnerability Details
/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
Impact
Changing sensitive information like a password for another user should not be possible.
Tools Used
Manual Review
POC
Coded POC to be added after imports in test file:
contract PasswordStoreTest is Test {
PasswordStore public passwordStore;
DeployPasswordStore public deployer;
address public owner;
address public random;
function setUp() public {
deployer = new DeployPasswordStore();
passwordStore = deployer.run();
owner = msg.sender;
random = address(0);
}
function test_non_owner_can_set_password() public {
vm.startPrank(owner);
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword); // setting expectedPassword as owner
vm.startPrank(random);
string memory maliciousPassword = "maliciousPassword";
passwordStore.setPassword(maliciousPassword); // setting maliciousPassword as random address
vm.startPrank(owner);
assertEq(passwordStore.getPassword(), expectedPassword); // comparing expectedPassword with new maliciousPassword set by arbitrary address, using owner for getPassword()
}
}
The assertion fails, which proves that the 2 strings are not equal, thus we can set a new password from any arbitrary address.
Recommendations
modifier onlyOwner() {
require(msg.sender == s_owner, "Not Owner");
_;
}
+ function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
Updates
Lead Judging Commences
inallhonesty
almost 2 years ago
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.