No Access Control On updateRegistry()
Summary
The updateRegistry() function has no access control.
Vulnerability Details
In GivingThanks.sol the updateRegistry() function has no access control allowing anyone to be able to set a new addrress for the registry.
Impact
This will result in an attacker being able to set a malicious address as the registry which they will have complete control of. This will allow an attacker to register and verify a malicious charity.
Tools Used
Manual Review
Recommendations
Since Openzeppelin's Ownable is being used, add the onlyOwner modifier to the updateRegistry() function.
Lead Judging Commences
finding-anyone-can-change-registry
Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.