GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Verification Check

abhishekthakur

Summary

The isVerified function in CharityRegistry returns registeredCharities status instead of verifiedCharities status, allowing donations to unverified charities.

Vulnerability Details

https://github.com/Cyfrin/2024-11-giving-thanks/blob/main/src/CharityRegistry.sol#L23-L25

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity]; // Audit: Returns registration status instead of verification
}

Registry contract handles the registered charities and verified charites in different mappings. Currently above function is using registeredCharities mapping instead of verifiedCharities.

This will allows unverified registries to bypass the checks in GivingThanks: donate due to following check:

function donate(address charity) public payable {\
@> require(registry.isVerified(charity), "Charity not verified");\
(bool sent,) = charity.call{value: msg.value}("");\
require(sent, "Failed to send Ether");
​
_mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}

POC

function testIncorrectVerificationCheck() public {
address unverifiedCharity = makeAddr("unverifiedCharity");
// Only register but don't verify
registryContract.registerCharity(unverifiedCharity);
// Should return false but returns true
assertTrue(registryContract.isVerified(unverifiedCharity));
}

Impact

  • Allows donations to unverified charities

  • Bypasses the core security mechanism of the platform

  • Compromises platform's trustworthiness

Tools Used

Manual Review, Foundry

Recommendations

This can be fixed by using correct mapping in isVerified function as given below.

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.