Submission Details
Severity:
Missing Input Validation for Donation Amount in `GivingThanks.sol`
Description: The GivingThanks::donate function accepts any value for donation without minimum or maximum limits.
function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
uint256 currentToken = tokenCounter++;
_mint(msg.sender, currentToken);
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(currentToken, uri);
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
}
Impact:
Possible dust attacks with minimal donations
Network spam through many small transactions
Storage bloat from unnecessary NFT mints
Recommended Mitigation:
uint256 public constant MIN_DONATION = 0.01 ether;
uint256 public constant MAX_DONATION = 100 ether;
function donate(address charity) public payable {
require(msg.value >= MIN_DONATION, "Donation too small");
require(msg.value <= MAX_DONATION, "Donation too large");
// ... rest of the function
}
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.