GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Any one can update registry in GivingThanks.sol

levi678

Summary

Lack of access control in GivingThanks.sol#updateRegistry allows anyone to update registry address.

Vulnerability Details

GivingThanks.sol#updateRegistry is public function with lack of access control which allows anyone to update the value of registry variable.

Impact

Anyone can update the address of registry. By doing so they can set a malicious contract as registry which on calling registry.isVerified(charity) will always returns true and make any charity eligible to earn donations.

Tools Used

Manual Review

Recommendations

Make the updateRegistry function only callable by the owner. For this these changes should be made:

function updateRegistry(address _registry) public {
+ require(msg.sender == owner, "Not allowed")
registry = CharityRegistry(_registry);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.