First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`PasswordStore::setPassword` Lack of Access Control make anyone able to change the password

abhishekthakur

Summary

Lack of Access Control in SetPassword Function

Vulnerability Details

The setPassword function in the contract allows anyone to set new password, which is not an intended behaviour.
As comments on the given function explain that only owner should be able to call it. But there is no check implemented to restrict this to be used by owner only. As a result, anybody can set the new password.

Impact

This will pose a significant risk to loss of original password. As anybody can make changes to it.

Tools Used

Manual review

Recommendations

Implement a proper access control using an if block, as given below.

function setPassword(string memory newPassword) external {
if(msg.sender != s_owner){
revert PasswordStore__NotOwner();
}
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.