GivingThanks

A donor can send some amount of eth to an untrusted or unverified charity. When an untrusted user registers as a charity, funds can be sent to the user without the admin verifying that the charity address is not a malicious user.

Add the code below to the `GivingThanks.t.sol` test suite and run `forge test --mt testCanDonateToUnverifiedCharity -vvv`

​

function testCanDonateToUnverifiedCharity() public {

address unverifiedCharity = address(0x4);

​

// Unverified charity registers but is not verified

vm.prank(unverifiedCharity);

registryContract.registerCharity(unverifiedCharity);

​

// Fund the donor

uint256 depositAmount = 10 ether;

vm.deal(donor, depositAmount);

uint256 initialDonorBlance = donor.balance;

uint256 initialUnverifiedCharityBalance = unverifiedCharity.balance;

console.log( "initial donor balance:", initialDonorBlance);

console.log("initial unverified balance:",initialUnverifiedCharityBalance);

// Donor tries to donate to unverified charity

vm.prank(donor);

charityContract.donate{value: donor.balance}(unverifiedCharity);

uint256 finalDonorBlance = donor.balance;

uint256 finalUnverifiedCharityBalance = unverifiedCharity.balance;

console.log("final donor balance:" ,finalDonorBlance);

console.log("final unverified charity balance:", finalUnverifiedCharityBalance);

assertEq(depositAmount, unverifiedCharity.balance);

assertEq(donor.balance, 0);

}

​

Funds can be sent to a malicious user without the consent of the admin

In the `CharityRegistry::isVerified()` function, `registeredCharities` is returned instead of `verifiedCharities`. The team should consider changing that.

​

- return registeredCharities[charity];

+ return verifiedCharities[charity];