GivingThanks

Summary:

The updateRegistry() function lacks access control allowing a malicious user to call the updaterRegistry() function, create a malicious registry, and receive donor funds.

Vulnerability Details:

https://github.com/Cyfrin/2024-11-giving-thanks/blob/main/src/GivingThanks.sol

function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}

1. no access control or modifier

2. no validation of new registry address

Impact:

1. Malicious actors could redirect donor funds to fraudulent charity contracts.

2. Donors may unknowingly interact with malicious registries.

3. potential loss of future donations through this compromised system.

Tools Used:

Manual review

Recommendations:

Add access control to updateRegistry() function.