GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[H-1] Incorrect Initialization of registry Variable Causes Denial of Service (DoS)

zyrrow

Summary

The registry variable in the GivingThanks::constructor` is incorrectly initialized with msg.sender rather than the _registry parameter. This misconfiguration prevents the donate function from verifying charities, making the contract unusable for its main purpose of processing donations.

Vulnerability Details

In the GivingThanks::constructor, the registry variable is set to msg.sender instead of _registry, which should be the actual address of the charity registry. This causes the donate function to fail at the verification step because isVerified checks cannot access the intended charity registry contract. As a result, any attempt to donate will trigger a revert.

Impact

This error leads to a complete denial of service for the contract. Since donations depend on the verification of charities, the entire functionality of the contract is blocked. No donations can be processed without verified charities, making the contract inoperable.

Tools Used

VS Code

Recommendations

Update the constructor to assign _registry to the registry variable, as shown below :

```

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}

```

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.