Missing owner/admin check
Summary
GivingThanks::updateRegistryfunction allows to change CharityRegistry contract address. This contract checks if charity is verfiied by admin.
Vulnerability Details
The function allows to change address by everyone. Funcion like this should contain owner/admin checks, which allows to change this address only by the owner/admin of the contract.
Impact
Malicious user can change the address, and charitites not verified by admin might be donated.
Tools Used
Manual review
Recommendations
Allow to call this function only for owner/admin by adding require statement or modifier.
Lead Judging Commences
finding-anyone-can-change-registry
Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.