GivingThanks

Summary

Lack of an access control feature in updateRegistry() which could potentially mislead donors into sending their funds to the wrong addresses.

Vulnerability Details

function updateRegistry(address _registry) public {
registry = CharityRegistry(_registry);
}

Anybody could call this function and update the address where the CharityRegistry contract is stored and with a wrong address, say containing another smartcontract allowing that manipulates the donor to fund a fake charity instead of a legitimate one.

Impact

Unsuspecting donors would be robbed of funds.

Tools Used

Manual review of the code.

Recommendations

Adding an access control feature in the updateRegistry as follows:

function updateRegistry(address _registry) public onlyOwner {
registry = CharityRegistry(_registry);
}

modifier onlyOwner(){

require(msg.sender == owner, "Not authorised!");

_ ;

}