First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Function setPassword does not check if the owner is setting the password or not

SubhradeepS158

Summary

The function "PasswordStore::setPassword" does not check whether the password is being set by the owner or by someone else. There should be a check added to the function for identifying whether it is the owner who is trying to set the password.

Vulnerability Details

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
​

Here the setPassword will be updated even if the function is called by anyone except the owner because there are no checks added to the function. This will lead to the loss of the password information stored by the owner.

This is the proof of my code - I used a test function "test_non_owner_can_set_password" for which the contract passed and proved the fact that anyone can set and overwrite the password stored.

function test_non_owner_can_set_password() public {
vm.startPrank(owner);
string memory ownerPassword = "myNewPassword1";
passwordStore.setPassword(ownerPassword);
vm.stopPrank();
vm.startPrank(address(1));
string memory nonOwnerPassword = "myNewPassword2";
passwordStore.setPassword(nonOwnerPassword);
vm.stopPrank();
vm.startPrank(owner);
string memory updatedPassword = passwordStore.getPassword();
assertEq(updatedPassword, nonOwnerPassword);
}

Impact

This vulnerability will lead to the loss of the password information stored by the owner, which is the core functionality of the contract.

Tools Used

Foundry

Recommendations

We need to add a check in the function "PasswordStore::setPassword" to check whether the owner is calling the function to update the password or not.

+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.