Submission Details
Severity:
Incorrect validation logic returns unverified charity as verified
Summary
CharityRegistry::isVerified is used to check if a charity is verified but the function checks the address in registeredCharities instead of verifiedCharities
Vulnerability Details
function verifyCharity(address charity) public {
require(msg.sender == admin, "Only admin can verify");
require(registeredCharities[charity], "Charity not registered");
verifiedCharities[charity] = true;
}
POC
Run this test to validate the issue
function testisVerified() public{
admin = makeAddr("admin");
charity = makeAddr("charity");
donor = makeAddr("donor");
vm.prank(admin);
registryContract = new CharityRegistry();
vm.prank(admin);
charityContract = new GivingThanks(address(registryContract));
vm.prank(admin);
registryContract.registerCharity(charity);
bool res = registryContract.isVerified(charity);
console.log(res);
assert(!res);
}
Impact
Unverified charities will be marked as verified
Updates
Lead Judging Commences
n0kto 12 months ago
Submission Judgement Published Assigned finding tags:
finding-isVerified-return-registered-charities
Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.