First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

setPassword function is having issues with access control

ETHANHUNTIMF99

Summary

The "function setPassword()" can be used or called by any address to set a new password.

Vulnerability Details

This is a security vulnerability because we want only the owner to be able to change the password.

@> function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Here is the test code from hardhat to show that it can be easily compromised.

describe("PasswordStore", function () {
let passwordStore;
let owner;
let otherUser;
​
beforeEach(async function () {
[owner, otherUser] = await ethers.getSigners();
​
const PasswordStore = await ethers.getContractFactory("PasswordStore");
passwordStore = await PasswordStore.deploy();
await passwordStore.deployed();
});
​
it("it should not allow other users to set the password", async function () {
// Trying to set the password from an address that is not the owner
await passwordStore.connect(otherUser).setPassword("CompromisedPassword");
​
// Ensuring that the password got changed
const password = await passwordStore.getPassword();
expect(password).to.equal("CompromisedPassword");
});
​

Impact

Stored" passwords" can be compromised very easily, it is very high vulnerability.

Tools Used

Hardhat + EthersJS

Recommendations

We should add access control to this function, to make sure that only the "owner" is able to call this function and set or change the "password". We can do this either by adding a modifier or just by checking with "if" condition that only "owner" should be able to change the password.

+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.