GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can donate to non-verified charities.

ahmedovv123

Summary

The protocol assumes that donation will be possible if the charity is accepted by a trusted admin, but the check function checks from the wrong mapping variable.

Vulnerability Details

CharityRegistry.sol::isVerified()function should return whether the charity is verified or not, but it checks the registeredCharitiesmapping and not the verifiedCharitiesone.

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity];
}

Impact

Breaks the protocol rule, donations to unverified charities.

Tools Used

Manual review.

Recommendations

Change isVerifiedfunction to

function isVerified(address charity) public view returns (bool) {
- return registeredCharities[charity];
+ return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.