Submission Details
Severity:
No access control in updateRegistry
Summary
updateRegistry is missing the access control which allows anyone to update the registry with malicious control.
Vulnerability Details
updateRegistry is missing the access control to prevent anyone from updating the registry to malicious control.
function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}
Impact
Malicious actors can update the registry to a malicious contract and misuse it to mint the NFT bypassing the isVerified check.
Tools Used
Manual review.
Recommendations
Add the access control check so only the owner of the contract can update the registry.
function updateRegistry(address _registry) public {
require(msg.sender == owner, "Only the owner can update the registry");
registry = CharityRegistry(_registry);
}
Updates
Lead Judging Commences
n0kto 12 months ago
Submission Judgement Published Assigned finding tags:
finding-anyone-can-change-registry
Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.