Submission Details
Severity:
Any address is allowed to alter the password
Summary
Missing owner check in setPassword Function
Vulnerability Details
A malicious user can alter the s_password variable thus compromising the integrity of the contract
Tools Used
Manual Review
Recommendations
Use OpenZeppellin's Ownable contract and make the setPassword Function exist with the onlyOwner modifier.
OR
add the following line of code : if(msg.sender != s_owner) revert PasswordStore__NotOwner(); before the line of code that changes the password to ensure only the contract's deployer can alter the password
Updates
Lead Judging Commences
inallhonesty
almost 2 years ago
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
finding-lacking-access-control
Anyone can call `setPassword` and set a new password contrary to the intended purpose.
Rewards breakdown
nSLOC
20This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.