GivingThanks

Summary

In the GivingThanks contract constructor, the registry variable is mistakenly assigned to msg.sender rather than _registry. This causes the donate function to fail, as msg.sender does not implement the necessary isVerified function expected from the CharityRegistry.

Vulnerability Details

The constructor sets the registry variable to msg.sender, instead of the provided _registry address, as shown below:

Since the registry address is incorrectly set to msg.sender, any call to registry.isVerified() in the donate function will fail, as the contract instance at msg.sender does not contain the required isVerified function. This effectively breaks donation functionality and prevents interactions with registered charities.

Impact

• Failure of the donate function: Without the correct registry address, the donate function cannot verify charities, leading to donation process failures.

• Contract Misconfiguration: Using msg.sender instead of _registry results in improper initialization, making the contract unable to perform as designed.

Tools Used

Manual Review

Recommendations

Assign the registry variable to _registry to ensure proper configuration:

This change ensures the GivingThanks contract is correctly initialized with the intended CharityRegistry address, restoring donation functionality and allowing proper charity verification.