GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

H-01. Incorrect Verification Check in isVerified Function

murelel

Summary

The isVerified function in the CharityRegistry contract incorrectly returns the registration status of charities rather than their verification status. Specifically, this function returns registeredCharities[charity] instead of verifiedCharities[charity], allowing donations to charities that are only registered, not verified. This misconfiguration can result in funds being sent to unverified charities. Updating the isVerified function to return verifiedCharities[charity] mitigates this vulnerability, ensuring only verified charities can receive donations as intended.

Vulnerability Details

The isVerified function currently returns registeredCharities[charity], which only indicates whether a charity has been registered, not verified. This oversight allows donations to charities that are registered but lack the intended verification status.

Details:

  • Incorrect return statement: The isVerified function currently returns the value of registeredCharities[charity], checking for registration rather than verification.

  • Impact: This allows donations to unverified charities, bypassing intended verification checks and reducing the contract’s trustworthiness.

This issue is resolved by modifying the isVerified function to return verifiedCharities[charity], ensuring that only verified charities are eligible to receive donations.

Code Analysis

Original isVerified Function in CharityRegistry:

function isVerified(address charity) public view returns (bool) {
return registeredCharities[charity]; // Incorrectly returns registration status
}

Corrected isVerified Function::

function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity]; // Correctly returns verification status
}

Proof of Concept (PoC)

function testDonateToUnverifiedCharity() public {
address unverifiedCharity = address(0x4);
uint256 donationAmount = 1 ether;
// Unverified charity registers but is not verified
vm.prank(unverifiedCharity);
registryContract.registerCharity(unverifiedCharity);
​
// Fund the donor
vm.deal(donor, 10 ether);
console.log(donor.balance);
// Donor tries to donate to unverified charity
vm.prank(donor);
charityContract.donate{value: donationAmount}(unverifiedCharity);
uint256 charityBalance = unverifiedCharity.balance;
assertEq(charityBalance, donationAmount);
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.