Submission Details
Severity:
Lack of validation for setPassword parameter
Summary
The function lacks validation, allowing for an empty string to be set as a password.
Vulnerability Details
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}
The function does not check if the string is empty.
Impact
An empty password can be set, undermining the security of the contract.
Tools Used
Manual review
Recommendations
function setPassword(string memory newPassword) external {
+ uint256 len = bytes(newPassword).length;
+ require(len != 0, "Password cannot be empty");
s_password = newPassword;
emit SetNetPassword();
}
Updates
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.