GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

no Zero Address check in `donate` Function

mo_

Description
As the is verified function is problamatic already , zero address can be registered and is verified check will return true if donate is called with zero addres . The donate function in the GivingThanks contract allows users to donate to a charity. However, there is no check to prevent donations to the zero address. If a user calls the donate function with the zero address as the charity, the function will execute successfully, leading to potential loss of funds since the Ether will be sent to the zero address.

Code Snippet

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");//@audit no zero address check . is verified is problamatic already . if zero address is provided , this call will success .
require(sent, "Failed to send Ether");
}

Impact

  • Loss of Funds: Users can unintentionally send Ether to the zero address, resulting in a permanent loss of funds, as there is no way to recover Ether sent to the zero address.

  • Security Vulnerability: This flaw can be exploited by malicious actors to create scenarios where users unknowingly donate to the zero address.

Recommendation
Implement a check in the donate function to ensure that the charity address is not the zero address before proceeding with the donation. This will prevent users from sending Ether to an invalid address.

Code Snippet

function donate(address charity) public payable {
require(charity != address(0), "Charity address cannot be zero");
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

mo_ Submitter
12 months ago
n0kto Lead Judge
12 months ago
n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.