GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Assignment of `_registry` Parameter in Constructor

Deleted user

Summary

The GivingThanks constructor does not use the _registry parameter to assign it as the value of the variable registry. Instead, it incorrectly assigns msg.sender to registry, which results in the variable not pointing to the CharityRegistry contract.

Vulnerability Details

The _registry parameter is passed to the constructor but remains unused. Instead of using this parameter, msg.sender is incorrectly assigned to registry. This causes registry to point to an incorrect address.

Impact

The variable registry does not point to the correct contract, causing the main logic of the contract to fail.

Tools Used

Foundry, Remix

Recommendations

Use the _registry parameter in the constructor to properly be assigned as the value of the variable registry.

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.