Summary

In the GivingThanks contract anybody can update the registry due to the lack of access control.

Vulnerability Details

Missing access control in GivingThanks::updateRegistry: The updateRegistry function lacks proper access control. This allows any attacker to call the function and replace the legitimate CharityRegistry contract address with a malicious one.

Impact

An attacker exploiting this vulnerability could:

• Redirect donations to a charity controlled by the attacker.

• Disrupt the intended flow of funds to legitimate charities.

• Damage the reputation of the GivingThanks platform.

Tools Used

Manual review

Recommendations

Implement an onlyOwner modifier in the updateRegistry function. This ensures that only the contract owner can update the CharityRegistry address.

Diff: