GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing owner check in `updateRegistry` in GivingThanks.sol

0xhyko

Summary

Missing owner check in updateRegistry can lead to changing the registery of GivingThanks contract https://github.com/Cyfrin/2024-11-giving-thanks/blob/main/src/GivingThanks.sol#L56.

function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}

Upon creating the contract the attacker can change the registery he controls.

Vulnerability Details

Missing owner check can lead to changing the registery of GivingThanks contract by anyone.

Impact

Suspicious charities can receive money from donors as they can control the whole registery.

Tools Used

forge

Recommendations

Limit only the update to the owner.

function updateRegistry(address _registry) public {
require(msg.sender == owner, "Only owner can update registry");
registry = CharityRegistry(_registry);
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.