First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can set password.

0xAbinash

Summary

The setPassword() allows anyone to set password.

Vulnerability Details

Here we have a function:

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

It is an external function and is not using any modifier which will put restriction on who can set password. As result any caller can set the password by just calling this function.

Impact

As this function allows anyone to set password the risk is high.

Tools Used

Manual inspection.

Recommendations

Use Openzeppelin's Ownable.sol contract's onlyOwner modifier on this function.
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/Ownable.sol

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 2 years ago
inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.