GivingThanks

Summary

The isVerified function in the CharityRegistry contract incorrectly validates whether a charity is verified by checking the registeredCharities mapping instead of checking the verifiedCharities mapping. This error results in the function confirming registration status instead of the verification status, which will mislead the GivingThanks contract to accept unverified charities as eligible for donations.

Vulnerability Details

The isVerified function should check if a charity is verified, but instead, it checks the registration status in the registeredCharities mapping. Since the GivingThanks contract relies on the isVerified function to verify charities before allowing donations, this incorrect validation allows unverified charities to be considered valid donation recipients.:

https://github.com/Cyfrin/2024-11-giving-thankxs/blob/304812abfc16df934249ecd4cd8dea38568a625d/src/CharityRegistry.sol#L23

Impact

This vulnerability renders the charity verification process useless as an unverified charity could bypass the security checks intended to safeguard donor contributions. Donors may unknowingly send funds to these unverified or potentially malicious charities, thereby reducing trust in the platform and its security measures.

Tools Used

Manual code review.

Recommendations

Update the isVerified function to correctly validate by checking the verifiedCharities mapping instead of the registeredCharities mapping: