GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong address of registry is set in GivingThanks.sol constructor

levi678

Summary

Wrong value ofregistry is set in GivingThanks.sol's constructor.

Vulnerability Details

In the constructor of GivingThanks.sol the registry variable is set to msg.sender instead of actual argument passed in constructor(address _registry)

Impact

In GivingThanks.sol the registry will be set to the msg.sender and registry.isVerfied(charity) can't be called in function donate(address charity) causing it to always revert.

Tools Used

Manual Review

Recommendations

In the constructor of GivingThanks.sol
Make these changes

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
- registry = CharityRegistry(msg.sender);
+ registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.