GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`CharityRegistry::isVerified` incorrectly mofidies `registeredCharities` instead of `verifiedCharities`, making unverified charities can receive donations

nap23

Summary

The isVerified function in CharityRegistry contract modifies the registeredCharities mapping instead of the verifiedCharities mapping. This allows unverified charities to receive donations.

Vulnerability Details

function isVerified(address charity) public view returns (bool) {
@> return registeredCharities[charity];
}

Impact

The logic of the contract is incorrect. The isVerified function should return whether the charity is verified or not. However, it returns whether the charity is registered or not. This allows unverified charities to receive donations.

Recommendations

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.