GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Users can donate 0 eth and still get an NFT token

nap23

Summary

There is no zero msg.Value check in the GivingThanks::donate function. This allows users to donate 0 eth and still get an NFT token. Moreover, they can get many NFTs in one 0 eth donation by combing with the reentrancy attack.

Impact

Users can get NFTs without donating any eth.

Recommendations

Adding zero value check in the donate function.

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
@> require(msg.value > 0, "Donation amount should be greater than 0");
...
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-0-donation-mint-an-NFT

Likelyhood: Low, anyone can mint an NFT with 0 amount. No reason to do it. Impact: Informational/Very Low, NFT are minted to a false donator. An NFT with 0 in the amount section would be useless. Since that's a bad design and not expected, I'll consider it Low but in a real contest, it could be informational because there is no real impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.