GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The `CharityRegistry::isVerified` function does not check if charity is verified but instead checks if charity is registered

phylax

Summary

The CharityRegistry::isVerified returns true if the charity is registered instead of if it's verified which is the intended functionality.

function isVerified(address charity) public view returns (bool) {
@> return registeredCharities[charity];
}

Vulnerability Details

This vulnerability makes it possible to donate to unverified charities because it passes the require statement in the GivingThanks::donate function.

function donate(address charity) public payable {
@> require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
_mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}

Removing the vm.expectRevert from the GivingThanksTest::testCannotDonateToUnverifiedCharity test function and the test will pass even though the charity is not verified by admin.

function testCannotDonateToUnverifiedCharity() public {
address unverifiedCharity = address(0x4);
​
// Unverified charity registers but is not verified
vm.prank(unverifiedCharity);
registryContract.registerCharity(unverifiedCharity);
​
// Fund the donor
vm.deal(donor, 10 ether);
​
// Donor tries to donate to unverified charity
vm.prank(donor);
- vm.expectRevert();
charityContract.donate{value: 1 ether}(unverifiedCharity);
}

Tools Used

Manual code review

Recommendations

Check if the charity is verified instead of registered in the `CharityRegistry::isVerified` function.

function isVerified(address charity) public view returns (bool) {
+ return verifiedCharities[charity];
- return registeredCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.