GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Check for Zero Donation in donate Function

bryanconquer

Summary

The donate function does not have a check to ensure that msg.value (the Ether sent by the user) is greater than zero. This means that users can send a donation of 0 ETH and still receive an NFT, which can lead to abuse of the system, where users may mint NFTs without actually making any contribution.

Vulnerability Details

In this code, there is no check on msg.value. Therefore, even if msg.value is zero, the _mint function will still be called, and the user will receive an NFT without actually donating any Ether.

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
// @audit. no check for zero eth transfer
(bool sent, ) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
_mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}
​

Impact

The user will receive an NFT with zero value, and the charity does not receive any donation.

Tools Used

manual review

Recommendations

Add a require statement to ensure that msg.value is greater than zero. Here’s the modified code with the fix:

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
require(msg.value > 0, "Donation amount must be greater than zero"); // Added check for non-zero donation
​
(bool sent, ) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
tokenCounter += 1; // Increment tokenCounter before minting
​
// Use safeMint instead of mint for better security
_safeMint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
​
emit DonationReceived(msg.sender, charity, msg.value, tokenCounter); // Optional: Emit an event
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-0-donation-mint-an-NFT

Likelyhood: Low, anyone can mint an NFT with 0 amount. No reason to do it. Impact: Informational/Very Low, NFT are minted to a false donator. An NFT with 0 in the amount section would be useless. Since that's a bad design and not expected, I'll consider it Low but in a real contest, it could be informational because there is no real impact.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.