GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No access control for function GivingThanks::updateRegistry allows anyone to change CharityRegistry used by the contract

al88nsk

Summary

Anyone can change address of CharityRegistry used by the contract. This allows an attacker to control verification status of charities.

Vulnerability Details

Function GivingThanks::updateRegistry does not have any access control in place. Therefore anyone can call the function and change CharityRegistry address. After that the attacker can control verification statuses of charities.

Impact

An attacker can change CharityRegistry address and make so that only the attacker's charity will be verified whila all other charities will not be verified. After that only the attacker's charity can be donated to.

Tools Used

Manual review

Recommendations

Add permissions check to the function GivingThanks::updateRegistry as show below:

function updateRegistry(address _registry) public {
+ require(msg.sender == owner, "Only owner can update registry");
registry = CharityRegistry(_registry);
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.