GivingThanks

Summary

The constructor in GivingThanks.sol incorrectly assigns the registry variable to msg.sender rather than the _registry address passed as a parameter. This results in GivingThanks referencing the deployer’s address as the CharityRegistry contract, which disrupts donation functionality, as verification checks will not work as intended. And currently makes it so that some of the tests included in the protocol do NOT pass.

Vulnerability Details

In the current constructor, registry is assigned to CharityRegistry(msg.sender), which treats the deployer’s address as the registry. This prevents the contract from correctly interacting with the CharityRegistry, causing functions that rely on it (like donate) to revert unexpectedly.

Current Code:

Failing Tests (No tests were added, this is simply what happens when running forge test with the code given):

Impact

By assigning registry incorrectly, donation functionality is disrupted, as verification checks fail. This effectively disables core functionality in GivingThanks, undermining the protocol’s usability and integrity.

Tools Used

• Manual code review.

• Testing (testDonate and testFuzzDonate) to confirm the error’s impact with Foundry.

Recommendations

To resolve this issue, assign registry to _registry directly in the constructor, actually using the parameter given in the constructor, as shown below:

This change ensures the contract references the correct CharityRegistry, restoring functionality to the protocol.

And the tests ran earlier should also pass accordingly: