GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Logic error in `CharityRegistry::isVerified` function, that returns `registeredCharities[charity]` instead of `verifiedCharities[charity]`

predator

Summary

CharityRegistry::isVerified function is responsible to return charity address, that is verified by admin. But it returns charity address, that enough to be just registered, that allow a donor to donate to charity, that might be not verified.

Additionally, donators would donate to charities, that might be malicious, but thinking they donate to verified charities.

function isVerified(address charity) public view returns (bool) {
@> return registeredCharities[charity];
}

Vulnerability Details

  1. Donator choose charity for donation.

  2. Donator donate money to a charity, assured donating to the verified charity.

Proof of Code

Place the following code to the GivingThanks.t.sol

function testIsVerifiedWorksWrong() public {
address newCharity = makeAddr("newCharity");
​
vm.prank(newCharity);
registryContract.registerCharity(newCharity);
​
// Donor donates to the charity
vm.deal(donor, 10 ether);
vm.prank(donor);
charityContract.donate{value: 1 ether}(newCharity);
}

Impact

This issue impact on donors, that assured that they donate to verified charities, but in the end to donate not verified charities.

Tools Used

Manual, Foundry

Recommendations

There's a way how to mitigate this issue:

function isVerified(address charity) public view returns (bool) {
- return registeredCharities[charity];
+ return verifiedCharities[charity];
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-isVerified-return-registered-charities

Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.