GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of access control in function `updateRegistrty()` in `GivingThanks.sol` allows anyone to update the address of the registry and change its logic by pointing the registry address to an arbitrary contract that steals donor funds

falde

Summary

function updateRegistry() has no access controls allowing anyone to change the address of registry and change the logic of CharityRegistry.sol. An attacker can deploy an arbitrary contract with different logic, i.e changing function isVerified whereby the attacker transfers the donated ether to themselves.

Vulnerability Details

function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}

This function allows anyone to call it and update registry to an arbitrary contract which could literally do anything like stealing donors funds.

Impact

Stealing of donors funds.

Tools Used

Manual review.

Recommendations

Add access control mechanism(s) to function updateRegistry(), e.g a modifier.

modifier onlyOwner(){
require(msg.sender == owner, "Error!");
_;
}
function updateRegistry(address _registry) public onlyOwner{
registry = CharityRegistry(_registry);
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.