GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Registry Initialization

abhishekthakur

Summary

The GivingThanks contract incorrectly initializes the CharityRegistry in the constructor by using msg.sender instead of the provided _registry parameter, leading to complete platform dysfunction.

Vulnerability Details

https://github.com/Cyfrin/2024-11-giving-thanks/blob/main/src/GivingThanks.sol#L15-L19

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
@> registry = CharityRegistry(msg.sender);
owner = msg.sender;
tokenCounter = 0;
}

As we can see in the highlighted line, it's using msg.sender instead of _registry. Which will set incorrect registry leading to failing other txns that are dependent on actual registry instance.

POC

function testIncorrectRegistryInitialization() public {
address deployer = address(this);
CharityRegistry registry = new CharityRegistry();
GivingThanks givingThanks = new GivingThanks(address(registry));
// The registry address will be the deployer instead of the intended registry
assertEq(address(givingThanks.registry()), deployer);
assertNotEq(address(givingThanks.registry()), address(registry));
}

Impact

  • Platform completely breaks as it uses wrong address for charity verification.

  • All donation attempts will fail

  • No charity can be verified correctly

Tools Used

Manual Review , Foundry

Recommendations

By using actual input rather hardcoding msg.sender will solve the issue.

​
constructor(address \_registry) ERC721("DonationReceipt", "DRC") {\
registry = CharityRegistry(\_registry); // Use the provided registry address\
owner = msg.sender;\
tokenCounter = 0;\
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.