First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Access Control Validation

wafflemakr

Summary

H-01 Lack of access control validation in a critical protocol function.

Vulnerability Details

In PasswordStore.sol:29, the function setPassword allows any address to set the password without any access control validation, as msg.sender is not checked to be the contract owner. This poses a serious security risk as any user can arbitrarily change the password which might not be the intent of the contract design.

Proof of Concept

The following unit test case passes, meaning the address(1) successfully changed the contract password

function test_random_user_can_set_password() public {
vm.startPrank(address(1)); // different from owner
passwordStore.setPassword("myNewPassword");
vm.stopPrank();
}

The output is shown below.

forge test --mt test_random_user_can_set_password
[⠢] Compiling...
No files changed, compilation skipped
​
Running 1 test for test/PasswordStore.t.sol:PasswordStoreTest
[PASS] test_random_user_can_set_password() (gas: 15107)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.68ms
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)

Impact

The impact of this security vulnerability is HIGH as it can result in unauthorized access and potential misuse of the smart contract. In a scenario where the password acts as a validation for withdrawing funds, allowing to freely set any password can lead to loss of funds.

Tools Used

Manual Review

Recommendations

To mitigate this security risk, it is recommended to consider utilizing an access control implementation such as OpenZeppelin's Ownable contract and the onlyOwner modifier. This contract provides a simple and secure way to restrict function call to only contract owner. Reference: OZ access control

function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.