GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Verification Logic in isVerified Function

cryptos

Description

The CharityRegistry::isVerified function is intended to check whether a charity is verified. However, it currently only checks if the charity is registered, not if it is actually verified. The function returns the value of registeredCharities[charity], which indicates whether a charity has been registered but does not account for whether it has been approved by an admin. As a result, unverified charities that are merely registered can still appear as "verified," potentially allowing unauthorized charities to use the system as if they had been fully verified.

Impact

This logic vulnerability may lead to unverified charities being treated as verified, as the system only checks for registration status and not verification status. This could result in donations being sent to unverified charities, undermining the trustworthiness of the platform and potentially leading to fraudulent activity.

Proof of Concept

Place this test in test/CharityRegistry.t.sol .

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
import "forge-std/Test.sol";
import "../src/CharityRegistry.sol";
​
contract CharityRegistryTest is Test {
CharityRegistry public charityRegistry;
address public admin;
address public unverifiedCharity = address(0x123);
​
function setUp() public {
vm.prank(admin);
charityRegistry = new CharityRegistry();
vm.stopPrank();
}
​
function testIsVerified_ReturnsTrueForRegisteredButUnverifiedCharity() public {
charityRegistry.registerCharity(unverifiedCharity);
​
bool isVerified = charityRegistry.isVerified(unverifiedCharity);
assertTrue(isVerified, "Unverified charity should not be considered verified");
}
}

Recommended Mitigation

Update the CharityRegistry::isVerified function to check both registration and verification status by referencing verifiedCharities[charity] instead of registeredCharities[charity]. This ensures that only charities approved by the admin are considered verified.

function isVerified(address charity) public view returns (bool) {
- return registeredCharities[charity];
+ return verifiedCharities[charity];
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.