First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`PasswordStore::setPassword()` missing access control lets everyone change the password

0xraion

Summary

The PasswordStore::setPassword() function lets any user change the password because of missing access control. This breaks core contract functionality because only the owner should be able to set a password.

Vulnerability Details

/*
* @notice This function allows only the owner to set a new password.
* @param newPassword The new password to set.
*/
function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

Like the code comments specify, only the owner should be able to set a new password. Because there are no checks at all, requiring the msg.sender to be the owner, core contract functionality gets broken allowing any user to set a password.

Impact

Any user can set a password.

PoC: (just add this test)

function test_anyone_can_set_password() public {
address randomUser = makeAddr("randomuser");
vm.startPrank(randomUser);
string memory expectedPassword = "randomPassword";
passwordStore.setPassword(expectedPassword);
vm.stopPrank();
vm.startPrank(owner);
string memory actualPassword = passwordStore.getPassword();
assertEq(actualPassword, expectedPassword);
}

Tools Used

manual analysis

Recommendations

add access control to the function:

- function setPassword(string memory newPassword) external {
- s_password = newPassword;
- emit SetNetPassword();
- }
+ function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
+ s_password = newPassword;
+ emit SetNetPassword();
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.