GivingThanks

Summary

The isVerified() function in the CharityRegistry contract incorrectly checks the registeredCharities mapping instead of the verifiedCharities mapping. This could lead to incorrect verification status being reported, potentially allowing unverified charities to receive donations through the GivingThanks contract.

Vulnerability Details

The CharityRegistry contract maintains two separate mappings: registeredCharities and verifiedCharities. The registerCharity() function adds a charity to the registeredCharities mapping, while the verifyCharity() function marks a registered charity as verified by setting the corresponding verifiedCharities mapping entry to true.

However, the isVerified() function, intended to check if a charity is verified, incorrectly checks the registeredCharities mapping instead of the verifiedCharities mapping. This means that the function will return true as long as a charity is registered, even if it has not been verified by the admin.

Impact

This issue could significantly impact the contract's functionality, which relies on the isVerified() function to ensure that donations are only made to verified charities. If the isVerified() function returns true for unverified charities, it could allow users to donate to these charities, potentially undermining the intended purpose of the platform.

Additionally, this bug could lead to user confusion and a loss of trust in the platform if donors cannot verify the legitimacy of the charities they are donating to.

Tools Used

Manual review

Recommendations

To resolve this issue, I recommend updating the isVerified() function to correctly check the verifiedCharities mapping