Missing access control to `GivingThanks::updateRegistry` function
Summary
The GivingThanks::updateRegistry function allows anyone to assign any address to the registry because the onlyOwner modifier is not used.
Vulnerability Details
Due to the lack of access control in GivingThanks::updateRegistry anyone can assign any address to registry, opening the door to linking a malicious contract controlled by an attacker.
Impact
Allows to redirect donations to addresses controlled by an attacker.
Tools Used
Foundry, Remix
Recommendations
Restrict access to the GivingThanks::updateRegistry function using the onlyOwner modifier.
Lead Judging Commences
finding-anyone-can-change-registry
Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.