First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Access Control in `setPassword` function

sm4rty

Summary

The contract lacks proper access control for the setPassword function, making it vulnerable to unauthorized changes in the password by anyone.

Vulnerability Details

The setPassword function's visibility is external and it does not contain any access control mechanisms. As a result, any address can call this function and change the stored password without restrictions.

Impact

Any malicious user can call the setPassword function and change the password

Tools Used

Manual Analysis

Recommendations

Add a require check for msg.sender == s_owner to the function.

function setPassword(string memory newPassword) external {
require(msg.sender == s_owner, "Only the current owner can transfer ownership");
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.