Submission Details
Severity:
donate() can allow donation by any users since isVerified() will always return true.
Summary
We are returing registeredCharities[charity] in isVerified() which will always return true and due to this donor can donate to unverified charities.
Vulnerability Details
Impact
Tools Used
Recommendations
Update isVerified() to return only verified charities, as:verifiedCharities
function isVerified(address charity) public view returns (bool) {
return verifiedCharities[charity];
}
Updates
Lead Judging Commences
n0kto 8 months ago
Submission Judgement Published Assigned finding tags:
finding-isVerified-return-registered-charities
Likelyhood: High, the function returns registered charities instead of verified ones. Impact: High, Any charities can be registered by anyone and will be declared as verified by this function bypassing verification.
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.