First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No ownership check for setPassword method

dadev

Summary

The setPassword function does not have an ownership check, allowing anyone to modify the password

Vulnerability Details

This means that an external actor can change the password without the owner's consent

Impact

This is a high impact vulnerability.
Malicious users can overwrite the password, leading to a potential loss of password when the owner calls the getPassword method it would return the changed password

POC: https://github.com/david-dacruz/2023-10-PasswordStore/blob/607f03007e930ff2a06804a96cae0d624e7224cf/test/PasswordStore.js#L47

Tools Used

Manual code inspection and POC with hardhat and chai

Recommendations

Implement an ownership modifier check mechanism
This can be done using by importing the Ownable contract by openzeppelin and using the onlyOwner modifier or with manual implementation

modifier onlyOwner() {
require(msg.sender == owner, "Unauthorized");
_;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.