GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Registry Removal Functionality in `CharityRegistry.sol`

mishraji874

Description: The contract lacks functionality to remove registered or verified charities, making it impossible to handle compromised or defunct charities.

Impact:

  • No way to remove malicious charities

  • Cannot update registry for defunct organizations

  • Permanent storage bloat

  • No ability to handle compromised charity addresses

Recommended Mitigation: Add functions to remove charities with appropriate access controls.

event CharityRemoved(address indexed charity);
​
function removeCharity(address charity) public onlyAdmin {
require(registeredCharities[charity], "Charity not registered");
registeredCharities[charity] = false;
verifiedCharities[charity] = false;
emit CharityRemoved(charity);
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-no-removal-function-for-malicous-charity-updates

Likelyhood: Low/Medium, charities can process an upgrade including a new unverified codebase. Impact: High, a charity can upgrade with bad function and bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.