First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

setPassword() can be used by anyone - high severity

coffee

Summary

The 'PasswordStore::setPassword' function can be ran by anyone and not just the owner. Because there is no owner check or onlyOwner modifier used in the function, anyone can set the password. A check needs to be added to make sure only the owner can run the function.

Vulnerability Details

@> function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Because there is no owner check or onlyOwner modifier used in the 'PasswordStore::setPassword' function, anyone can set the password. An owner check similar to the one used in the 'PasswordStore::getPassword' function should be used to prevent anyone other than the owner from setting the password.

Impact

This test passes as true. When there is a non-owner address that calls the setPassword() function there are no checks to stop this from happening. Only the owner should be able to call this function.

// here is my proof test
function test_non_owner_can_set_password() public {
string memory expectedPassword = "myNewPassword";
@> vm.startPrank(address(1));
@> passwordStore.setPassword(expectedPassword);
vm.stopPrank();
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

[PASS] test_non_owner_can_set_password() (gas: 22838)

Tools Used

-Foundry

Recommendations

Include a check to make sure the address calling the setPassword function is the owner and revert if it is not.

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!