GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

updateRegistry Function Vulnerability

bbash

Summary

The updateRegistry function allows unrestricted updates to the registry address, introducing a potential security risk.

Vulnerability Details

Without proper access control, an attacker could modify the registry address to a malicious contract.

https://github.com/Cyfrin/2024-11-giving-thanks/blob/main/src/GivingThanks.sol#L56-L58

function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}

Impact

Unauthorized changes to registry could direct donations or verification checks to a fraudulent registry, undermining donor trust and platform security.

Tools Used

Manual Review

Recommendations

Restrict access to updateRegistry by either using OpenZeppelin’s Ownable contract or removing the function if updating the registry is unnecessary. Updated function with access control:

function updateRegistry(address _registry) public onlyOwner {
registry = CharityRegistry(_registry);
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-anyone-can-change-registry

Likelyhood: High, anyone can change it at anytime Impact: High, can bypass the verification process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.