First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

s_password can be mutated by any account address

silvana

Summary

Contract's function mutating the s_password can be called by any address because it lacks check of the msg.sender.

Vulnerability Details

Following function can be called by any account address:

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Following test, added in PasswordStore.t.sol proves the issue:

function test_non_owner_can_set_password() public {
vm.startPrank(address(1));
string memory expectedPassword = "passwordSetByNonOwner";
// Here we would want the transaction to revert, but it doesn't.
passwordStore.setPassword(expectedPassword);
vm.stopPrank();
​
// Here we test the new value of the password.
// Indeed, the password was set by the non-owner.
// Notice, the password reading IS protected by the owner check, so we need to prank with the address of the owner
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

Impact

Critical

Tools Used

Manual review was used.

No automatic tools for code analysis were used.

Standard tools described in https://book.getfoundry.sh/ were used to deploy, test and query the contract.

Recommendations

Protect via modifier:

modifier onlyOwner() {
if (msg.sender != i_owner) revert PasswordStore__NotOwner();
_;
}

The functions that are supposed to be executed only by the owner of the contract should use that modifier in their signature:

function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.