GivingThanks

Summary

The updateRegistry function in GivingThanks allows any user to update the CharityRegistry address, which could lead to malicious modifications of the verified charity list.

Vulnerability Details

In the GivingThanks contract, the updateRegistry function does not restrict access, allowing any caller to update the CharityRegistry address. This opens the possibility for an attacker to redirect all verification checks to a different registry, enabling unverified charities to receive donations.

Impact

An unauthorized user could exploit this to bypass verification controls, compromising the platform’s security by allowing unverified addresses to act as charities. This could lead to donation redirection, effectively stealing funds intended for verified charities.

Tools Used

Manual Code Review

Recommendations

Restrict the updateRegistry function to only allow the owner (contract deployer) to update the registry address.