First Flight #1: PasswordStore
The CodeHawks team has launched an exceptionally useful tool for us, the junior auditors. This tool allows us to practice and learn with simpler audits and shorter codes, yet with utilities that we can find in the web3 environment.
Throughout this journey, I will share some of the vulnerabilities that I come across. These experiences will help us all grow and improve our auditing skills. But this journey is not just mine, it’s ours. So if you find any additional vulnerabilities, don’t hesitate to share them in the comments.
From First Flight #1: PasswordStore is a simple Solidity protocol meant to allow the owner to store and retrieve their password securely. For more information, you can check it out here.
We have discovered two vulnerabilities: one High and one Low.
H-01 | The function setPassword can be called by anyone.
Relevant GitHub Link
Description: In the setPassword function, there is no check to ensure that the user calling it is the Owner. This means that any user can modify the password.
Get Pol Gallardo’s stories in your inbox
Join Medium for free to get updates from this writer.
The following POC demonstrates that anyone can change the password:
Resolution: The setPassword function should be restricted to only be callable by the Owner.
L-01 | The setPassword function has an event with a misleading description
Relevant GitHub Link
Description: In the setPassword function, the name of the event emitted during password update has a typographical error: “SetNetPassword” instead of “SetNewPassword”.
Recommendation: Correct the typographical error by setting the event name to “SetNewPassword”.
These vulnerabilities highlight the importance of thorough security reviews at every stage of development. With the spirit of collaboration and continuous improvement, I hope this analysis proves valuable to the developer community, fostering a more robust approach to security in the web3 environment. Let’s continue working together to build a safer and more reliable future for all!
