Submission Details
Severity:
setPassword() can be called by anyone causing the password to be changed by anyone
Summary
setPassword() function visibility is set to external and there is no access control or a logic to revert the function if the caller of the function is not msg.sender. Any EOA or contract can change the password.
Vulnerability Details
Impact
Anyone can change the password
Tools Used
Manual audit
Recommendations
Adding revert can be a solution to prevent others to change the password with the setPassword() function similar to what has been done in getPassword() function.
Updates
Lead Judging Commences
inallhonesty
about 2 years ago
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.