GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong mapping checks

howiecht

Summary

Using wrong mapping to check if the charity is verified.

Vulnerability Details

GivingThanks::donate(address charity)is required charity address is verified by CharityRegistry::isVerified(address charity), however, CharityRegistry::isVerified(address charity) use registeredCharities[charity] to check if the charity is verified, which will make anyone could register and accept donation without verifing by the Admin. It should use verifiedCharities[charity]instead.

Impact

Unverified charity is able to receive donation.

Tools Used

Foundry Test

Recommendations

function isVerified(address charity) public view returns (bool) {
+ return verifiedCharities[charity];
- return registeredCharities[charity];
}

After modified, testCannotDonateToUnverifiedCharity() works.

Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.