GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Reentrancy Vulnerability in donate Function

bbash

Summary

The donate function transfers Ether to an external address and then performs other operations, making it susceptible to reentrancy attacks.

Vulnerability Details

Without reentrancy protection, the function is vulnerable to reentrancy attacks, where a malicious contract could repeatedly call donate and drain funds.

https://github.com/Cyfrin/2024-11-giving-thanks/blob/main/src/GivingThanks.sol#L21-L33

function donate(address charity) public payable {
require(registry.isVerified(charity), "Charity not verified");
(bool sent,) = charity.call{value: msg.value}("");
require(sent, "Failed to send Ether");
​
_mint(msg.sender, tokenCounter);
​
// Create metadata for the tokenURI
string memory uri = _createTokenURI(msg.sender, block.timestamp, msg.value);
_setTokenURI(tokenCounter, uri);
​
tokenCounter += 1;
}

Impact

If exploited, this vulnerability could lead to loss of user funds and undermine the contract’s financial security.

Tools Used

Manual Review

Recommendations

Use OpenZeppelin’s ReentrancyGuard and apply the nonReentrant modifier to the donate function:

function donate(address charity) public payable nonReentrant { ... }
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.