Incorrect Initialization of registry in Constructor in GivingThanks contract
Summary
The registry is incorrectly initialized to the deployer's address (msg.sender) instead of the provided _registry address.
Vulnerability Details
In the constructor, registry = CharityRegistry(msg.sender); sets the registry to the deployer's address. This could lead to incorrect or unintended behavior since the registry should point to a specific CharityRegistry contract.
Impact
The contract may not function as intended, as it would not verify charities against the correct registry.
Tools Used
Manual Review
Recommendations
Initialize registry with the _registry parameter provided to the constructor. Change the line to:
Lead Judging Commences
finding-bad-registry-set-at-construction
Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.