GivingThanks

First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Missing owner/admin check

Summary

GivingThanks::updateRegistryfunction allows to change CharityRegistry contract address. This contract checks if charity is verfiied by admin.

Vulnerability Details

The function allows to change address by everyone. Funcion like this should contain owner/admin checks, which allows to change this address only by the owner/admin of the contract.

Impact

Malicious user can change the address, and charitites not verified by admin might be donated.

Tools Used

Manual review

Recommendations

Allow to call this function only for owner/admin by adding require statement or modifier.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.