First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The setPassword() function should be restricted to owner

falconhoof

Summary

The setPassword() function should be restricted to owner

Vulnerability Details

Current implementation of the PasswordStore.sol contract allows anyone to update the password.

Impact

Having the setPassword function open for anyone to use breaks the stated aim of the protocol to only allow the owner to set the password. If they rely on the protocol to store their password without any backup and somebody changes it they lose that password forever.

Tools Used

Manual Review

Recommendations

Use the same Access Control in setPassword() as is used in getPassword()

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.