GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Security Audit Report for GivingThanks Smart Contracts

5an1tyb0y

Date: 13.11.2024

Vulnerability: Incorrect Constructor Initialization in GivingThanks Contract

Severity: High

Description:
In the constructor of the GivingThanks contract, the registry variable is incorrectly initialized to CharityRegistry(msg.sender) instead of using the passed _registry parameter. This mistake causes the contract to reference a CharityRegistry instance deployed by the GivingThanks contract’s owner instead of the intended CharityRegistry instance. As a result, the GivingThanks contract may operate with an invalid or unauthorized CharityRegistry contract, leading to potential vulnerabilities such as unauthorized charity verification or denial of service.

Mitigation:
Modify the constructor to correctly initialize the registry variable using the provided _registry parameter:

constructor(address _registry) ERC721("DonationReceipt", "DRC") {
registry = CharityRegistry(_registry);
owner = msg.sender;
tokenCounter = 0;
}
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-bad-registry-set-at-construction

Likelyhood: High, the parameter is not well used and won't be set. Impact: Low, can be changed with the setter and no one will be able to donate to malicious charity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.