GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Mixed up use of `CharityRegistry::registeredCharities` and `CharityRegistry::verifiedCharities` returns false verification status for charity

trashpirate

Summary

The function CharityRegistry::isVerified returning a boolean that indicates whether a charity is verified or not always returns true for any registred charity.

Vulnerability Details

Due to mix up of the state variables (mappings) CharityRegistry::registeredCharities andCharityRegistry::verifiedCharitiesany registered charity returns truewhen CharityRegistry::isVerified is called. The test GivingThanks.t:testCannotDonateToUnverifiedCharity passes because the donate function reverts when called. However, it reverts due to a bug in the constructor, not because the charity is not verified.

Proof of Concept

  1. User registers a charity

  2. User donates before charity is verified

  3. Charity is considered as verified and donation is accepted

Code:

Use explicit revert check for GivingThanks.t:testCannotDonateToUnverifiedCharity:

function testCannotDonateToUnverifiedCharity() public {
address unverifiedCharity = address(0x4);
​
// Unverified charity registers but is not verified
vm.prank(unverifiedCharity);
registryContract.registerCharity(unverifiedCharity);
​
// Fund the donor
vm.deal(donor, 10 ether);
​
// Donor tries to donate to unverified charity
vm.prank(donor);
+ vm.expectRevert(bytes("Charity not verified"));
- vm.expectRevert();
charityContract.donate{value: 1 ether}(unverifiedCharity);
}

Test will fail with:

[FAIL: call reverted as expected, but without data]

Impact

The check if a charity is verified in GivingThanks::donatewill always return true for a registered charity. This breaks the verification mechanism by the admin.

Tools Used

Foundry, manual review

Recommendations

Fix the mixed up state variables:

function isVerified(address charity) public view returns (bool) {
- return registeredCharities[charity];
+ return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.