GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Not verfiied charities might be donated

adamn

Summary

User can create charity using CharityRegistry::registerCharity function. Then, the charity is saved in CharityRegistry::verifiedCharities mapping. Admin can verify this charity with CharityRegistry::verifyCharity function, and then charity can be donated.

Vulnerability Details

Function CharityRegistry::isVerified checks if charity has been verified by the admin. This function should check if CharityRegistry::registeredCharitymapping contain the charity address. However in this function is used wrong mapping, only checks if charity is registered.

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity];
}

Impact

Charities not verified by admin but only registered might be donated.

Tools Used

Manual review

Recommendations

Change mapping as below.

function isVerified(address charity) public view returns (bool) {
- return registeredCharities[charity];
+ return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.