GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Verification Check in isVerified Function of CharityRegistry Contract

bryanconquer

Summary

The isVerified function in the CharityRegistry contract contains a critical bug where it incorrectly returns the value from registeredCharities rather than verifiedCharities. This means that any charity that has been registered, regardless of whether it has been verified, will appear as verified in the system.

Vulnerability Details

The isVerified function currently returns registeredCharities[charity], which checks only if a charity is registered. The function should instead check verifiedCharities[charity] to determine if the charity has been verified.

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity]; // @audit should call verifiedCharities
}
​

Impact

Any address that is registered as a charity will appear as verified, even if it has not been verified by the admin. This could lead to unauthorized or unverified charities gaining access to features or interactions intended only for verified charities.

Tools Used

manual reviews

Recommendations

Modify the isVerified function to check verifiedCharities instead of registeredCharities.

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.