GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect registry assignment in Constructor

solgoodman

Summary

The GivingThanks constructor incorrectly assigns msg.sender as the registry address instead of using the provided _registry parameter.

Vulnerability Details

In GivingThanks.sol, the constructor is improperly initializing the registry address:

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
registry = CharityRegistry(msg.sender); // Should be _registry
owner = msg.sender;
tokenCounter = 0;
}

The issue is that the constructor is setting msg.sender as a CharityRegistry contract instead of using the intended _registry parameter. This means the contract will try to interact with the deployer's address as if it were a CharityRegistry contract.

Impact

On deployment, the contract will be permanently linked to an incorrect registry address, in this case, the deployer's address, instead of the intended charity registry contract. Any calls to verify charities or process donations will fail as the deployer's address cannot respond to the required registry function calls. This makes the contract unusable from the moment of deployment unless the registry is updated through a separate transaction.

Tools Used

  • Manual Review

  • Remix IDE

Recommendations

Correct the constructor to use the provided registry parameter and add proper validation:

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
- registry = CharityRegistry(msg.sender);
+ registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!