GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Logic in `isVerified` Function

spidy7301

Summary

The isVerified function is intended to check if a charity is verified. However, it currently returns the registration status instead of the verification status.

Vulnerability Details

The isVerified function references the registeredCharities mapping instead of verifiedCharities

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity];
}
​

POC

function testCannotDonateToUnverifiedCharity() public {
address unverifiedCharity = address(0x4);
​
// Unverified charity registers but is not verified
vm.prank(unverifiedCharity);
registryContract.registerCharity(unverifiedCharity);
​
// Fund the donor
vm.deal(donor, 10 ether);
​
// Donor tries to donate to unverified charity
vm.prank(donor);
vm.expectRevert();
charityContract.donate{value: 1 ether}(unverifiedCharity);
}
​

Output

forge test --match-test testCannotDonateToUnverifiedCharity
[⠆] Compiling...
No files changed, compilation skipped
​
Ran 1 test for test/GivingThanks.t.sol:GivingThanksTest
[FAIL. Reason: call did not revert as expected] testCannotDonateToUnverifiedCharity() (gas: 307716)
Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 5.11ms (887.20µs CPU time)
​
Ran 1 test suite in 63.10ms (5.11ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)
​

Impact

  • Users calling this function will receive incorrect information, believing a charity is verified when it is only registered.

  • This could lead to donations being made under the false assumption of verification, undermining trust in the system.

Tools Used

Manual Code Review and Foundry Unit Test

Recommendations

The function should instead return the status from the verifiedCharities mapping, which holds the verification status of each charity.

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.