Submission Details
Severity:
Any user can get stored password
Summary
getPassword() can be break by triggering setPassword() first
Vulnerability Details
getPassword() is ok but bug is present in setPassword() by hitting that function will become the owner of the contract and read sensitive data.
Impact
Anyone can hit setPassword() and set new password after that that user can get password by triggering getPassword().
Tools Used
Manual code review
Recommendations
Use modifier or make require statement for checking that user must be owner in setPassword()
function setPassword(string memory newPassword) external {
+ require(msg.sender == s_owner, "not owner");
s_password = newPassword;
emit SetNetPassword();
}
Updates
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.