Submission Details
Severity:
Centralization Risk in Registry Verification
Description: Both contracts CharityRegistry and GivingThanks rely on a single admin for charity verification, creating a central point of failure.
Impact:
System vulnerability to admin key compromise
Single point of failure for verification
Potential system deadlock if admin is unavailable
Recommended Mitigation:
contract MultiSigCharityRegistry {
uint256 public constant MIN_SIGNATURES = 2;
mapping(address => bool) public isAdmin;
mapping(address => mapping(bytes32 => bool)) public hasSignedVerification;
function verifyCharity(address charity) public {
bytes32 verificationHash = keccak256(abi.encodePacked(charity));
require(isAdmin[msg.sender], "Not admin");
hasSignedVerification[msg.sender][verificationHash] = true;
uint256 signatures = 0;
for (uint i = 0; i < admins.length; i++) {
if (hasSignedVerification[admins[i]][verificationHash]) {
signatures++;
}
}
if (signatures >= MIN_SIGNATURES) {
verifiedCharities[charity] = true;
emit CharityVerified(charity);
}
}
}
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.