GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Contract Address Assignment in GivingThanks::constructor

i_atiq

Description

In the GivingThanks contract, the constructor incorrectly assigns msg.sender to initialize the CharityRegistry instance, rather than using the intended _registry address passed as a parameter. This approach assigns the deployer’s address to the registry variable, which does not correspond to the actual CharityRegistry contract deployed address.

Impact

This misassignment results in the registry variable pointing to an incorrect address, causing any function calls or interactions with registry to revert, as the assigned address is not a valid instance of CharityRegistry. Consequently, functionalities reliant on CharityRegistry methods, data or contract interactions are rendered unusable, disrupting the intended operation of the contract.

Recommended Mitigation

Replace msg.sender with _registry in the constructor to correctly assign the CharityRegistry address provided by the _registry parameter:

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
- registry = CharityRegistry(msg.sender);
+ registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.