GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Bug in constructor makes contract unusable

kalodfreelancer

Summary

Not using the correct address for initializing theCharityRegistryin the constructor of GivingThanks would lead to the need of a redeployment of the protocol, because it would be unusable

Vulnerability Details

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
registry = CharityRegistry(msg.sender); // @audit pass _registry here
owner = msg.sender;
tokenCounter = 0;
}

The only way this could not have been an issue would be if the initalizing contract was the registry, but that is not possible in the current contracts.

Impact

Low - Funds would not be lost, because they could not be received in the first place. Only redeployment costs should be considered.

Recommendations

Be extra careful to check for unused variables in the entire codebase.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.