Submission Details
Severity:
Any user can call setPassword(string memory)
Summary
Any user can set password
Vulnerability Details
setPassword(string memory) is expected to be called only by the Owner, but in fact it can be set by anyone. PoC attached.
function test_non_owner_can_set_password() public {
vm.startPrank(address(1));
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}
Impact
The PasswordStore::sols_password can be set by any one.
Tools Used
Foundry
Recommendations
function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
Add check if msg.sender is owner to the setPassword function
Updates
Lead Judging Commences
inallhonesty
almost 2 years ago
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.