First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The setPassword function can be called by anyone, which leads to unexpected behaviour of the smart contract

marcologonz

Summary

The PasswordStore::setPassword function is designed to allow only the owner to set a new password. But the way it is implemented allows anyone to set a new password.

Vulnerability Details

The function does not implement any access control, such as a modifier or a require where msg.sender can be checked.

Impact

The protocol does not works how it should, due to the fact that any user can change the password.

Tools Used

Foundry

Recommendations

The PasswordStore::setPassword function must be modified to check the msg.sender. One possible way is the following:

function setPassword(string memory newPassword) external {
@> if (msg.sender != s_owner) {
@> revert PasswordStore__NotOwner();
@> }
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.