First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`setPassword()` function has zero access control, anyone can call this function and set/change the password for the user

0xscsamurai

Summary

setPassword() function has zero access control, anyone can call this function and set/change the password for the user.

Total lack of access control in any form whatsoever in this function, which would allow anyone to change the user's password at any time.

Vulnerability Details

n/a

Impact

If anyone other than the owner changes this password, the owner would have lost access to his/her current (correct) password permanently and hence lost access to any accounts which they used this password for, completely obliterating the idea/intention behind the contract, to safekeep the owner's (current) password.

Tools Used

VSC

Recommendations

Add a function modifier or a require() or if/revert check inside the function, as per below:

function setPassword(string memory newPassword) external {
++ if (msg.sender != s_owner) revert PasswordStore__NotOwner();
s_password = newPassword;
emit SetNetPassword();
}

OR

Create a new modifier in the contract for access control:

modifier onlyOwner() {
require(msg.sender == s_owner, "Only the owner can call this function");
_;
}

OR

modifier onlyOwner() {
if (msg.sender != s_owner) revert NotOwner();
_;
}

And then add the modifier to this function:

-- function setPassword(string memory newPassword) external {
++ function setPassword(string memory newPassword) external onlyOwner {
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

0xscsamurai Submitter
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.