First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Ownership validation is missing in "setPassword" anyone can set the password.

Heba

Summary

In PasswordStore::setPassword() the function misses a validation that the owner is the only one who can set the newPassword, which makes it possible for a malicious actor to set the password and steal the contract's assets.

Vulnerability Details

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

the function should have a modifier or a validation that the caller is the contract's owner as this is a critical function
no one else should be able to access it.

Impact

All Assets and sensitive data will be compromised if a malicious actor sets the password.

Tools Used

Manual review

Recommendations

Add a OZ OnlyOwner modifier or add the following validation after the function opening

if (msg.sender != s_owner) {
revert PasswordStore__NotOwner();
}```
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.