GivingThanks

Summary

The vulnerability in the GivingThanks contract's constructor arises because it initializes the registry variable with CharityRegistry(msg.sender) instead of using the _registry parameter passed to the constructor. This mistake sets the registry to the address of the contract deployer (msg.sender) rather than the actual CharityRegistry contract. As a result, any subsequent calls to registry.isVerified fail, since the isVerified function will attempt to access mappings on an invalid address

Vulnerability Details

In the GivingThanks contract constructor, the registry variable is incorrectly initialized with:

This line should instead be:

By assigning registry to msg.sender, the contract treats the deployer's address as the CharityRegistry contract, which is incorrect. Any calls to registry will now reference the deployer's address instead of the intended CharityRegistry contract.

Specifically, the line:

Will always fail because registry.isVerified is referencing the isVerified function on an address that is not the CharityRegistry contract. This causes the donation function to revert, making it impossible to donate to any charity, even if it has been properly registered and verified.

Impact

This vulnerability results in the following:

• Inability to donate: Since registry.isVerified(charity) will always fail, the donate function will revert for any charity. As a result, users will be unable to donate using this contract.
  Recommendation

Recommendations

Correct the constructor: Update the constructor to use _registry instead of msg.sender to initialize the registry variable.

Also this vulnerability I think should be in Low, because the registry address can be changed with the updateRegistry(address _registry) function in the GivingThanks.sol contract.