First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone Can Set Password

ihtishamsudo

Summary

Anyone can set Password because function is external and lack access control

Vulnerability Details

See Summary

Impact

Anyone can set password other than owner which is not safe for owner to store and retrieve password.

POC

Here is the test written in foundry to test if anyone can set password.
Add this test in PasswordStore.t.sol and run forge test.

function test_anyone_can_set_pass() public {
vm.startPrank(address(1));
passwordStore.setPassword("Passs");
}

pranking as address(1) which is not owner.

and Test passes as follows.

[⠰] Compiling...
[⠒] Compiling 1 files with 0.8.18
[⠆] Solc 0.8.18 finished in 4.63s
Compiler run successful!
​
Running 3 tests for test/PasswordStore.t.sol:PasswordStoreTest
[PASS] test_anyone_can_set_pass() (gas: 14712)
[PASS] test_non_owner_reading_password_reverts() (gas: 12765)
[PASS] test_owner_can_set_password() (gas: 22141)
Test result: ok. 3 passed; 0 failed; 0 skipped; finished in 4.35ms

Tools Used

Foundry

Recommendations

Use modifiers like onlyOnwer or OpenZeppelin Ownable Library to implement OnlyOwner Modifier. i.e
modifier onlyOwner() external {
require (owner = msg.sender)
}
and implement it as follows in vulnerable function.

function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.